commit: cb1b258f488e4532ba65f26c66a1e03d2ff3a471 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Oct 14 20:35:24 2020 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Oct 14 20:35:24 2020 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=cb1b258f
Linux patch 4.14.201 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1200_linux-4.14.201.patch | 2893 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2897 insertions(+) diff --git a/0000_README b/0000_README index 952497e..9cff2cf 100644 --- a/0000_README +++ b/0000_README @@ -843,6 +843,10 @@ Patch: 1199_linux-4.14.200.patch From: https://www.kernel.org Desc: Linux 4.14.200 +Patch: 1200_linux-4.14.201.patch +From: https://www.kernel.org +Desc: Linux 4.14.201 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1200_linux-4.14.201.patch b/1200_linux-4.14.201.patch new file mode 100644 index 0000000..5836d3e --- /dev/null +++ b/1200_linux-4.14.201.patch @@ -0,0 +1,2893 @@ +diff --git a/Makefile b/Makefile +index 0fde7a0de1dd0..e3e2d7fa72325 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 200 ++SUBLEVEL = 201 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index aa1a2d32360f9..392e2b462560e 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -377,7 +377,8 @@ static int really_probe(struct device *dev, struct device_driver *drv) + drv->bus->name, __func__, drv->name, dev_name(dev)); + if (!list_empty(&dev->devres_head)) { + dev_crit(dev, "Resources present before probing\n"); +- return -EBUSY; ++ ret = -EBUSY; ++ goto done; + } + + re_probe: +@@ -486,7 +487,7 @@ pinctrl_bind_failed: + ret = 0; + done: + atomic_dec(&probe_count); +- wake_up(&probe_waitqueue); ++ wake_up_all(&probe_waitqueue); + return ret; + } + +diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c +index 3d30262219275..2d269cc6a6688 100644 +--- a/drivers/clk/samsung/clk-exynos4.c ++++ b/drivers/clk/samsung/clk-exynos4.c +@@ -1075,7 +1075,7 @@ static const struct samsung_gate_clock exynos4210_gate_clks[] __initconst = { + GATE(CLK_PCIE, "pcie", "aclk133", GATE_IP_FSYS, 14, 0, 0), + GATE(CLK_SMMU_PCIE, "smmu_pcie", "aclk133", GATE_IP_FSYS, 18, 0, 0), + GATE(CLK_MODEMIF, "modemif", "aclk100", GATE_IP_PERIL, 28, 0, 0), +- GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, 0, 0), ++ GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0), + GATE(CLK_SYSREG, "sysreg", "aclk100", E4210_GATE_IP_PERIR, 0, + CLK_IGNORE_UNUSED, 0), + GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4210_GATE_IP_PERIR, 11, 0, +@@ -1116,7 +1116,7 @@ static const struct samsung_gate_clock exynos4x12_gate_clks[] __initconst = { + 0), + GATE(CLK_TSADC, "tsadc", "aclk133", E4X12_GATE_BUS_FSYS1, 16, 0, 0), + GATE(CLK_MIPI_HSI, "mipi_hsi", "aclk133", GATE_IP_FSYS, 10, 0, 0), +- GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, 0, 0), ++ GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0), + GATE(CLK_SYSREG, "sysreg", "aclk100", E4X12_GATE_IP_PERIR, 1, + CLK_IGNORE_UNUSED, 0), + GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4X12_GATE_IP_PERIR, 11, 0, +diff --git a/drivers/gpio/gpio-tc3589x.c b/drivers/gpio/gpio-tc3589x.c +index 433b45ef332e5..6dd2ee89bca4f 100644 +--- a/drivers/gpio/gpio-tc3589x.c ++++ b/drivers/gpio/gpio-tc3589x.c +@@ -209,7 +209,7 @@ static void tc3589x_gpio_irq_sync_unlock(struct irq_data *d) + continue; + + tc3589x_gpio->oldregs[i][j] = new; +- tc3589x_reg_write(tc3589x, regmap[i] + j * 8, new); ++ tc3589x_reg_write(tc3589x, regmap[i] + j, new); + } + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +index df24494299791..eea17a8511b3b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +@@ -284,7 +284,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set, + take the current one */ + if (active && !adev->have_disp_power_ref) { + adev->have_disp_power_ref = true; +- goto out; ++ return ret; + } + /* if we have no active crtcs, then drop the power ref + we got before */ +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index bc746131987ff..ae700e445fbc8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -727,6 +727,7 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_tt *ttm) + + release_sg: + kfree(ttm->sg); ++ ttm->sg = NULL; + return r; + } + +diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c +index 889c95d4feecc..3f71bc3d93fef 100644 +--- a/drivers/gpu/drm/drm_syncobj.c ++++ b/drivers/gpu/drm/drm_syncobj.c +@@ -355,7 +355,6 @@ static int drm_syncobj_handle_to_fd(struct drm_file *file_private, + return PTR_ERR(file); + } + +- drm_syncobj_get(syncobj); + fd_install(fd, file); + + *p_fd = fd; +diff --git a/drivers/gpu/drm/sun4i/sun8i_mixer.c b/drivers/gpu/drm/sun4i/sun8i_mixer.c +index cb193c5f16862..519610e0bf660 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c ++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c +@@ -235,7 +235,7 @@ static struct regmap_config sun8i_mixer_regmap_config = { + .reg_bits = 32, + .val_bits = 32, + .reg_stride = 4, +- .max_register = 0xbfffc, /* guessed */ ++ .max_register = 0xffffc, /* guessed */ + }; + + static int sun8i_mixer_bind(struct device *dev, struct device *master, +diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c +index 8a8ca945561b0..7eba874a981d3 100644 +--- a/drivers/i2c/busses/i2c-cpm.c ++++ b/drivers/i2c/busses/i2c-cpm.c +@@ -74,6 +74,9 @@ struct i2c_ram { + char res1[4]; /* Reserved */ + ushort rpbase; /* Relocation pointer */ + char res2[2]; /* Reserved */ ++ /* The following elements are only for CPM2 */ ++ char res3[4]; /* Reserved */ ++ uint sdmatmp; /* Internal */ + }; + + #define I2COM_START 0x80 +diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c +index 88d15b92ec35e..efde272c0bf67 100644 +--- a/drivers/i2c/busses/i2c-meson.c ++++ b/drivers/i2c/busses/i2c-meson.c +@@ -8,6 +8,7 @@ + * published by the Free Software Foundation. + */ + ++#include <linux/bitfield.h> + #include <linux/clk.h> + #include <linux/completion.h> + #include <linux/i2c.h> +@@ -39,6 +40,12 @@ + #define REG_CTRL_CLKDIVEXT_SHIFT 28 + #define REG_CTRL_CLKDIVEXT_MASK GENMASK(29, 28) + ++#define REG_SLV_ADDR GENMASK(7, 0) ++#define REG_SLV_SDA_FILTER GENMASK(10, 8) ++#define REG_SLV_SCL_FILTER GENMASK(13, 11) ++#define REG_SLV_SCL_LOW GENMASK(27, 16) ++#define REG_SLV_SCL_LOW_EN BIT(28) ++ + #define I2C_TIMEOUT_MS 500 + + enum { +@@ -142,6 +149,9 @@ static void meson_i2c_set_clk_div(struct meson_i2c *i2c, unsigned int freq) + meson_i2c_set_mask(i2c, REG_CTRL, REG_CTRL_CLKDIVEXT_MASK, + (div >> 10) << REG_CTRL_CLKDIVEXT_SHIFT); + ++ /* Disable HIGH/LOW mode */ ++ meson_i2c_set_mask(i2c, REG_SLAVE_ADDR, REG_SLV_SCL_LOW_EN, 0); ++ + dev_dbg(i2c->dev, "%s: clk %lu, freq %u, div %u\n", __func__, + clk_rate, freq, div); + } +@@ -269,7 +279,10 @@ static void meson_i2c_do_start(struct meson_i2c *i2c, struct i2c_msg *msg) + token = (msg->flags & I2C_M_RD) ? TOKEN_SLAVE_ADDR_READ : + TOKEN_SLAVE_ADDR_WRITE; + +- writel(msg->addr << 1, i2c->regs + REG_SLAVE_ADDR); ++ ++ meson_i2c_set_mask(i2c, REG_SLAVE_ADDR, REG_SLV_ADDR, ++ FIELD_PREP(REG_SLV_ADDR, msg->addr << 1)); ++ + meson_i2c_add_token(i2c, TOKEN_START); + meson_i2c_add_token(i2c, token); + } +@@ -425,6 +438,10 @@ static int meson_i2c_probe(struct platform_device *pdev) + return ret; + } + ++ /* Disable filtering */ ++ meson_i2c_set_mask(i2c, REG_SLAVE_ADDR, ++ REG_SLV_SDA_FILTER | REG_SLV_SCL_FILTER, 0); ++ + meson_i2c_set_clk_div(i2c, timings.bus_freq_hz); + + return 0; +diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c +index d68aba9c5dd62..673bfbb01ca2e 100644 +--- a/drivers/input/mouse/trackpoint.c ++++ b/drivers/input/mouse/trackpoint.c +@@ -297,6 +297,8 @@ static int trackpoint_start_protocol(struct psmouse *psmouse, + case TP_VARIANT_ALPS: + case TP_VARIANT_ELAN: + case TP_VARIANT_NXP: ++ case TP_VARIANT_JYT_SYNAPTICS: ++ case TP_VARIANT_SYNAPTICS: + if (variant_id) + *variant_id = param[0]; + if (firmware_id) +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 7c05e09abacf9..51bd2ebaa342c 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -725,6 +725,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nopnp_table[] = { + DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"), + }, + }, ++ { ++ /* Acer Aspire 5 A515 */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "Grumpy_PK"), ++ DMI_MATCH(DMI_BOARD_VENDOR, "PK"), ++ }, ++ }, + { } + }; + +diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c +index 13485a40dd46c..f4ebef29c644b 100644 +--- a/drivers/iommu/exynos-iommu.c ++++ b/drivers/iommu/exynos-iommu.c +@@ -1296,13 +1296,17 @@ static int exynos_iommu_of_xlate(struct device *dev, + return -ENODEV; + + data = platform_get_drvdata(sysmmu); +- if (!data) ++ if (!data) { ++ put_device(&sysmmu->dev); + return -ENODEV; ++ } + + if (!owner) { + owner = kzalloc(sizeof(*owner), GFP_KERNEL); +- if (!owner) ++ if (!owner) { ++ put_device(&sysmmu->dev); + return -ENOMEM; ++ } + + INIT_LIST_HEAD(&owner->controllers); + mutex_init(&owner->rpm_lock); +diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c +index f74f9ef460cc9..218472879d9ce 100644 +--- a/drivers/mmc/core/queue.c ++++ b/drivers/mmc/core/queue.c +@@ -143,7 +143,7 @@ static void mmc_queue_setup_discard(struct request_queue *q, + q->limits.discard_granularity = card->pref_erase << 9; + /* granularity must not be greater than max. discard */ + if (card->pref_erase > max_discard) +- q->limits.discard_granularity = 0; ++ q->limits.discard_granularity = SECTOR_SIZE; + if (mmc_can_secure_erase_trim(card)) + queue_flag_set_unlocked(QUEUE_FLAG_SECERASE, q); + } +diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c +index d6e31e8a7b668..916e0ccd1e27e 100644 +--- a/drivers/mtd/nand/sunxi_nand.c ++++ b/drivers/mtd/nand/sunxi_nand.c +@@ -2125,7 +2125,7 @@ static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc, + ret = mtd_device_register(mtd, NULL, 0); + if (ret) { + dev_err(dev, "failed to register mtd device: %d\n", ret); +- nand_release(nand); ++ nand_cleanup(nand); + return ret; + } + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 861d2c0a521a4..6aaf1196d9a55 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1129,6 +1129,7 @@ static void bond_setup_by_slave(struct net_device *bond_dev, + + bond_dev->type = slave_dev->type; + bond_dev->hard_header_len = slave_dev->hard_header_len; ++ bond_dev->needed_headroom = slave_dev->needed_headroom; + bond_dev->addr_len = slave_dev->addr_len; + + memcpy(bond_dev->broadcast, slave_dev->broadcast, +diff --git a/drivers/net/ethernet/dec/tulip/de2104x.c b/drivers/net/ethernet/dec/tulip/de2104x.c +index c87b8cc429638..6ca15c595f543 100644 +--- a/drivers/net/ethernet/dec/tulip/de2104x.c ++++ b/drivers/net/ethernet/dec/tulip/de2104x.c +@@ -91,7 +91,7 @@ MODULE_PARM_DESC (rx_copybreak, "de2104x Breakpoint at which Rx packets are copi + #define DSL CONFIG_DE2104X_DSL + #endif + +-#define DE_RX_RING_SIZE 64 ++#define DE_RX_RING_SIZE 128 + #define DE_TX_RING_SIZE 64 + #define DE_RING_BYTES \ + ((sizeof(struct de_desc) * DE_RX_RING_SIZE) + \ +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 19fb3dbb80f58..9f4d93a16b7e5 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1374,51 +1374,6 @@ static inline int ravb_hook_irq(unsigned int irq, irq_handler_t handler, + return error; + } + +-/* MDIO bus init function */ +-static int ravb_mdio_init(struct ravb_private *priv) +-{ +- struct platform_device *pdev = priv->pdev; +- struct device *dev = &pdev->dev; +- int error; +- +- /* Bitbang init */ +- priv->mdiobb.ops = &bb_ops; +- +- /* MII controller setting */ +- priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); +- if (!priv->mii_bus) +- return -ENOMEM; +- +- /* Hook up MII support for ethtool */ +- priv->mii_bus->name = "ravb_mii"; +- priv->mii_bus->parent = dev; +- snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", +- pdev->name, pdev->id); +- +- /* Register MDIO bus */ +- error = of_mdiobus_register(priv->mii_bus, dev->of_node); +- if (error) +- goto out_free_bus; +- +- return 0; +- +-out_free_bus: +- free_mdio_bitbang(priv->mii_bus); +- return error; +-} +- +-/* MDIO bus release function */ +-static int ravb_mdio_release(struct ravb_private *priv) +-{ +- /* Unregister mdio bus */ +- mdiobus_unregister(priv->mii_bus); +- +- /* Free bitbang info */ +- free_mdio_bitbang(priv->mii_bus); +- +- return 0; +-} +- + /* Network device open function for Ethernet AVB */ + static int ravb_open(struct net_device *ndev) + { +@@ -1427,13 +1382,6 @@ static int ravb_open(struct net_device *ndev) + struct device *dev = &pdev->dev; + int error; + +- /* MDIO bus init */ +- error = ravb_mdio_init(priv); +- if (error) { +- netdev_err(ndev, "failed to initialize MDIO\n"); +- return error; +- } +- + napi_enable(&priv->napi[RAVB_BE]); + napi_enable(&priv->napi[RAVB_NC]); + +@@ -1511,7 +1459,6 @@ out_free_irq: + out_napi_off: + napi_disable(&priv->napi[RAVB_NC]); + napi_disable(&priv->napi[RAVB_BE]); +- ravb_mdio_release(priv); + return error; + } + +@@ -1810,8 +1757,6 @@ static int ravb_close(struct net_device *ndev) + ravb_ring_free(ndev, RAVB_BE); + ravb_ring_free(ndev, RAVB_NC); + +- ravb_mdio_release(priv); +- + return 0; + } + +@@ -1913,6 +1858,51 @@ static const struct net_device_ops ravb_netdev_ops = { + .ndo_set_mac_address = eth_mac_addr, + }; + ++/* MDIO bus init function */ ++static int ravb_mdio_init(struct ravb_private *priv) ++{ ++ struct platform_device *pdev = priv->pdev; ++ struct device *dev = &pdev->dev; ++ int error; ++ ++ /* Bitbang init */ ++ priv->mdiobb.ops = &bb_ops; ++ ++ /* MII controller setting */ ++ priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); ++ if (!priv->mii_bus) ++ return -ENOMEM; ++ ++ /* Hook up MII support for ethtool */ ++ priv->mii_bus->name = "ravb_mii"; ++ priv->mii_bus->parent = dev; ++ snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", ++ pdev->name, pdev->id); ++ ++ /* Register MDIO bus */ ++ error = of_mdiobus_register(priv->mii_bus, dev->of_node); ++ if (error) ++ goto out_free_bus; ++ ++ return 0; ++ ++out_free_bus: ++ free_mdio_bitbang(priv->mii_bus); ++ return error; ++} ++ ++/* MDIO bus release function */ ++static int ravb_mdio_release(struct ravb_private *priv) ++{ ++ /* Unregister mdio bus */ ++ mdiobus_unregister(priv->mii_bus); ++ ++ /* Free bitbang info */ ++ free_mdio_bitbang(priv->mii_bus); ++ ++ return 0; ++} ++ + static const struct of_device_id ravb_match_table[] = { + { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 }, + { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 }, +@@ -2142,6 +2132,13 @@ static int ravb_probe(struct platform_device *pdev) + eth_hw_addr_random(ndev); + } + ++ /* MDIO bus init */ ++ error = ravb_mdio_init(priv); ++ if (error) { ++ dev_err(&pdev->dev, "failed to initialize MDIO\n"); ++ goto out_dma_free; ++ } ++ + netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64); + netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64); + +@@ -2164,6 +2161,8 @@ static int ravb_probe(struct platform_device *pdev) + out_napi_del: + netif_napi_del(&priv->napi[RAVB_NC]); + netif_napi_del(&priv->napi[RAVB_BE]); ++ ravb_mdio_release(priv); ++out_dma_free: + dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, + priv->desc_bat_dma); + +@@ -2196,6 +2195,7 @@ static int ravb_remove(struct platform_device *pdev) + unregister_netdev(ndev); + netif_napi_del(&priv->napi[RAVB_NC]); + netif_napi_del(&priv->napi[RAVB_BE]); ++ ravb_mdio_release(priv); + pm_runtime_disable(&pdev->dev); + free_netdev(ndev); + platform_set_drvdata(pdev, NULL); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +index 8c71090081852..5105e1f724fb7 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +@@ -677,23 +677,16 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev, + struct stmmac_priv *priv = netdev_priv(dev); + int ret; + +- if (!edata->eee_enabled) { ++ if (!priv->dma_cap.eee) ++ return -EOPNOTSUPP; ++ ++ if (!edata->eee_enabled) + stmmac_disable_eee_mode(priv); +- } else { +- /* We are asking for enabling the EEE but it is safe +- * to verify all by invoking the eee_init function. +- * In case of failure it will return an error. +- */ +- edata->eee_enabled = stmmac_eee_init(priv); +- if (!edata->eee_enabled) +- return -EOPNOTSUPP; +- } + + ret = phy_ethtool_set_eee(dev->phydev, edata); + if (ret) + return ret; + +- priv->eee_enabled = edata->eee_enabled; + priv->tx_lpi_timer = edata->tx_lpi_timer; + return 0; + } +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index 4a92160394c07..834fa544d6d93 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -1081,6 +1081,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + struct macsec_rx_sa *rx_sa; + struct macsec_rxh_data *rxd; + struct macsec_dev *macsec; ++ unsigned int len; + sci_t sci; + u32 pn; + bool cbit; +@@ -1236,9 +1237,10 @@ deliver: + macsec_rxsc_put(rx_sc); + + skb_orphan(skb); ++ len = skb->len; + ret = gro_cells_receive(&macsec->gro_cells, skb); + if (ret == NET_RX_SUCCESS) +- count_rx(dev, skb->len); ++ count_rx(dev, len); + else + macsec->secy.netdev->stats.rx_dropped++; + +diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig +index cd931cf9dcc26..e08d822338341 100644 +--- a/drivers/net/phy/Kconfig ++++ b/drivers/net/phy/Kconfig +@@ -146,6 +146,7 @@ config MDIO_THUNDER + depends on 64BIT + depends on PCI + select MDIO_CAVIUM ++ select MDIO_DEVRES + help + This driver supports the MDIO interfaces found on Cavium + ThunderX SoCs when the MDIO bus device appears as a PCI +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 396a8c6cb9992..d36d0882874bd 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -299,7 +299,7 @@ inst_rollback: + for (i--; i >= 0; i--) + __team_option_inst_del_option(team, dst_opts[i]); + +- i = option_count - 1; ++ i = option_count; + alloc_rollback: + for (i--; i >= 0; i--) + kfree(dst_opts[i]); +@@ -2078,6 +2078,7 @@ static void team_setup_by_port(struct net_device *dev, + dev->header_ops = port_dev->header_ops; + dev->type = port_dev->type; + dev->hard_header_len = port_dev->hard_header_len; ++ dev->needed_headroom = port_dev->needed_headroom; + dev->addr_len = port_dev->addr_len; + dev->mtu = port_dev->mtu; + memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len); +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index 875639b0e9d56..e7193a541244b 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -1736,6 +1736,7 @@ static const struct driver_info belkin_info = { + .status = ax88179_status, + .link_reset = ax88179_link_reset, + .reset = ax88179_reset, ++ .stop = ax88179_stop, + .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .rx_fixup = ax88179_rx_fixup, + .tx_fixup = ax88179_tx_fixup, +diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c +index b807c91abe1da..a22ae3137a3f8 100644 +--- a/drivers/net/usb/rndis_host.c ++++ b/drivers/net/usb/rndis_host.c +@@ -213,7 +213,7 @@ int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen) + dev_dbg(&info->control->dev, + "rndis response error, code %d\n", retval); + } +- msleep(20); ++ msleep(40); + } + dev_dbg(&info->control->dev, "rndis response timeout\n"); + return -ETIMEDOUT; +diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c +index 48ba80a8ca5ce..3f4fc78498e03 100644 +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -277,12 +277,20 @@ static int write_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 reg) + return 1; + } + +-static inline void set_ethernet_addr(rtl8150_t * dev) ++static void set_ethernet_addr(rtl8150_t *dev) + { +- u8 node_id[6]; ++ u8 node_id[ETH_ALEN]; ++ int ret; ++ ++ ret = get_registers(dev, IDR, sizeof(node_id), node_id); + +- get_registers(dev, IDR, sizeof(node_id), node_id); +- memcpy(dev->netdev->dev_addr, node_id, sizeof(node_id)); ++ if (ret == sizeof(node_id)) { ++ ether_addr_copy(dev->netdev->dev_addr, node_id); ++ } else { ++ eth_hw_addr_random(dev->netdev); ++ netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n", ++ dev->netdev->dev_addr); ++ } + } + + static int rtl8150_set_mac_address(struct net_device *netdev, void *p) +diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c +index 7f99fb666f196..1587789ba9343 100644 +--- a/drivers/net/wan/hdlc_cisco.c ++++ b/drivers/net/wan/hdlc_cisco.c +@@ -120,6 +120,7 @@ static void cisco_keepalive_send(struct net_device *dev, u32 type, + skb_put(skb, sizeof(struct cisco_packet)); + skb->priority = TC_PRIO_CONTROL; + skb->dev = dev; ++ skb->protocol = htons(ETH_P_HDLC); + skb_reset_network_header(skb); + + dev_queue_xmit(skb); +diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c +index 78596e42a3f3f..5a8dbeaf1a427 100644 +--- a/drivers/net/wan/hdlc_fr.c ++++ b/drivers/net/wan/hdlc_fr.c +@@ -435,6 +435,8 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev) + if (pvc->state.fecn) /* TX Congestion counter */ + dev->stats.tx_compressed++; + skb->dev = pvc->frad; ++ skb->protocol = htons(ETH_P_HDLC); ++ skb_reset_network_header(skb); + dev_queue_xmit(skb); + return NETDEV_TX_OK; + } +@@ -557,6 +559,7 @@ static void fr_lmi_send(struct net_device *dev, int fullrep) + skb_put(skb, i); + skb->priority = TC_PRIO_CONTROL; + skb->dev = dev; ++ skb->protocol = htons(ETH_P_HDLC); + skb_reset_network_header(skb); + + dev_queue_xmit(skb); +@@ -1045,7 +1048,7 @@ static void pvc_setup(struct net_device *dev) + { + dev->type = ARPHRD_DLCI; + dev->flags = IFF_POINTOPOINT; +- dev->hard_header_len = 10; ++ dev->hard_header_len = 0; + dev->addr_len = 2; + netif_keep_dst(dev); + } +@@ -1097,6 +1100,7 @@ static int fr_add_pvc(struct net_device *frad, unsigned int dlci, int type) + dev->mtu = HDLC_MAX_MTU; + dev->min_mtu = 68; + dev->max_mtu = HDLC_MAX_MTU; ++ dev->needed_headroom = 10; + dev->priv_flags |= IFF_NO_QUEUE; + dev->ml_priv = pvc; + +diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c +index d42b861cc8965..4381e7310be02 100644 +--- a/drivers/net/wan/hdlc_ppp.c ++++ b/drivers/net/wan/hdlc_ppp.c +@@ -254,6 +254,7 @@ static void ppp_tx_cp(struct net_device *dev, u16 pid, u8 code, + + skb->priority = TC_PRIO_CONTROL; + skb->dev = dev; ++ skb->protocol = htons(ETH_P_HDLC); + skb_reset_network_header(skb); + skb_queue_tail(&tx_queue, skb); + } +diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c +index 15177a54b17d7..e5fc1b95cea6a 100644 +--- a/drivers/net/wan/lapbether.c ++++ b/drivers/net/wan/lapbether.c +@@ -201,8 +201,6 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb) + struct net_device *dev; + int size = skb->len; + +- skb->protocol = htons(ETH_P_X25); +- + ptr = skb_push(skb, 2); + + *ptr++ = size % 256; +@@ -213,6 +211,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb) + + skb->dev = dev = lapbeth->ethdev; + ++ skb->protocol = htons(ETH_P_DEC); ++ + skb_reset_network_header(skb); + + dev_hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0); +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index e95d2f75713e1..7e3f3055a6777 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -3012,12 +3012,14 @@ nvme_fc_create_ctrl(struct device *dev, struct nvmf_ctrl_options *opts) + spin_lock_irqsave(&nvme_fc_lock, flags); + list_for_each_entry(lport, &nvme_fc_lport_list, port_list) { + if (lport->localport.node_name != laddr.nn || +- lport->localport.port_name != laddr.pn) ++ lport->localport.port_name != laddr.pn || ++ lport->localport.port_state != FC_OBJSTATE_ONLINE) + continue; + + list_for_each_entry(rport, &lport->endp_list, endp_list) { + if (rport->remoteport.node_name != raddr.nn || +- rport->remoteport.port_name != raddr.pn) ++ rport->remoteport.port_name != raddr.pn || ++ rport->remoteport.port_state != FC_OBJSTATE_ONLINE) + continue; + + /* if fail to get reference fall through. Will error */ +diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c +index b854f1ee5de57..4ef3618bca93f 100644 +--- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c ++++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c +@@ -418,7 +418,7 @@ static struct mvebu_mpp_mode mv98dx3236_mpp_modes[] = { + MPP_VAR_FUNCTION(0x1, "i2c0", "sck", V_98DX3236_PLUS)), + MPP_MODE(15, + MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_98DX3236_PLUS), +- MPP_VAR_FUNCTION(0x4, "i2c0", "sda", V_98DX3236_PLUS)), ++ MPP_VAR_FUNCTION(0x1, "i2c0", "sda", V_98DX3236_PLUS)), + MPP_MODE(16, + MPP_VAR_FUNCTION(0x0, "gpo", NULL, V_98DX3236_PLUS), + MPP_VAR_FUNCTION(0x4, "dev", "oe", V_98DX3236_PLUS)), +diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig +index 09035705d0a07..4f872e62508a8 100644 +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -183,6 +183,7 @@ config FUJITSU_LAPTOP + depends on BACKLIGHT_CLASS_DEVICE + depends on ACPI_VIDEO || ACPI_VIDEO = n + select INPUT_SPARSEKMAP ++ select NEW_LEDS + select LEDS_CLASS + ---help--- + This is a driver for laptops built by Fujitsu: +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index c3fb9d66b7683..ffaaccded34e6 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -2477,7 +2477,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn, + */ + static int hotkey_kthread(void *data) + { +- struct tp_nvram_state s[2]; ++ struct tp_nvram_state s[2] = { 0 }; + u32 poll_mask, event_mask; + unsigned int si, so; + unsigned long t; +@@ -6749,8 +6749,10 @@ static int __init tpacpi_query_bcl_levels(acpi_handle handle) + list_for_each_entry(child, &device->children, node) { + acpi_status status = acpi_evaluate_object(child->handle, "_BCL", + NULL, &buffer); +- if (ACPI_FAILURE(status)) ++ if (ACPI_FAILURE(status)) { ++ buffer.length = ACPI_ALLOCATE_BUFFER; + continue; ++ } + + obj = (union acpi_object *)buffer.pointer; + if (!obj || (obj->type != ACPI_TYPE_PACKAGE)) { +diff --git a/drivers/spi/spi-fsl-espi.c b/drivers/spi/spi-fsl-espi.c +index 1d332e23f6ede..6a39ba5840c2e 100644 +--- a/drivers/spi/spi-fsl-espi.c ++++ b/drivers/spi/spi-fsl-espi.c +@@ -556,13 +556,14 @@ static void fsl_espi_cpu_irq(struct fsl_espi *espi, u32 events) + static irqreturn_t fsl_espi_irq(s32 irq, void *context_data) + { + struct fsl_espi *espi = context_data; +- u32 events; ++ u32 events, mask; + + spin_lock(&espi->lock); + + /* Get interrupt events(tx/rx) */ + events = fsl_espi_read_reg(espi, ESPI_SPIE); +- if (!events) { ++ mask = fsl_espi_read_reg(espi, ESPI_SPIM); ++ if (!(events & mask)) { + spin_unlock(&espi->lock); + return IRQ_NONE; + } +diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c +index 03fb995d359ee..f62cdf1238d77 100644 +--- a/drivers/usb/gadget/function/f_ncm.c ++++ b/drivers/usb/gadget/function/f_ncm.c +@@ -1210,7 +1210,6 @@ static int ncm_unwrap_ntb(struct gether *port, + const struct ndp_parser_opts *opts = ncm->parser_opts; + unsigned crc_len = ncm->is_crc ? sizeof(uint32_t) : 0; + int dgram_counter; +- bool ndp_after_header; + + /* dwSignature */ + if (get_unaligned_le32(tmp) != opts->nth_sign) { +@@ -1237,7 +1236,6 @@ static int ncm_unwrap_ntb(struct gether *port, + } + + ndp_index = get_ncm(&tmp, opts->ndp_index); +- ndp_after_header = false; + + /* Run through all the NDP's in the NTB */ + do { +@@ -1253,8 +1251,6 @@ static int ncm_unwrap_ntb(struct gether *port, + ndp_index); + goto err; + } +- if (ndp_index == opts->nth_size) +- ndp_after_header = true; + + /* + * walk through NDP +@@ -1333,37 +1329,13 @@ static int ncm_unwrap_ntb(struct gether *port, + index2 = get_ncm(&tmp, opts->dgram_item_len); + dg_len2 = get_ncm(&tmp, opts->dgram_item_len); + +- if (index2 == 0 || dg_len2 == 0) +- break; +- + /* wDatagramIndex[1] */ +- if (ndp_after_header) { +- if (index2 < opts->nth_size + opts->ndp_size) { +- INFO(port->func.config->cdev, +- "Bad index: %#X\n", index2); +- goto err; +- } +- } else { +- if (index2 < opts->nth_size + opts->dpe_size) { +- INFO(port->func.config->cdev, +- "Bad index: %#X\n", index2); +- goto err; +- } +- } + if (index2 > block_len - opts->dpe_size) { + INFO(port->func.config->cdev, + "Bad index: %#X\n", index2); + goto err; + } + +- /* wDatagramLength[1] */ +- if ((dg_len2 < 14 + crc_len) || +- (dg_len2 > frame_max)) { +- INFO(port->func.config->cdev, +- "Bad dgram length: %#X\n", dg_len); +- goto err; +- } +- + /* + * Copy the data into a new skb. + * This ensures the truesize is correct +@@ -1380,6 +1352,8 @@ static int ncm_unwrap_ntb(struct gether *port, + ndp_len -= 2 * (opts->dgram_item_len * 2); + + dgram_counter++; ++ if (index2 == 0 || dg_len2 == 0) ++ break; + } while (ndp_len > 2 * (opts->dgram_item_len * 2)); + } while (ndp_index); + +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c +index 3f2f34ebf51f5..27f3b471c95bf 100644 +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -383,6 +383,52 @@ static bool vhost_vsock_more_replies(struct vhost_vsock *vsock) + return val < vq->num; + } + ++static struct virtio_transport vhost_transport = { ++ .transport = { ++ .get_local_cid = vhost_transport_get_local_cid, ++ ++ .init = virtio_transport_do_socket_init, ++ .destruct = virtio_transport_destruct, ++ .release = virtio_transport_release, ++ .connect = virtio_transport_connect, ++ .shutdown = virtio_transport_shutdown, ++ .cancel_pkt = vhost_transport_cancel_pkt, ++ ++ .dgram_enqueue = virtio_transport_dgram_enqueue, ++ .dgram_dequeue = virtio_transport_dgram_dequeue, ++ .dgram_bind = virtio_transport_dgram_bind, ++ .dgram_allow = virtio_transport_dgram_allow, ++ ++ .stream_enqueue = virtio_transport_stream_enqueue, ++ .stream_dequeue = virtio_transport_stream_dequeue, ++ .stream_has_data = virtio_transport_stream_has_data, ++ .stream_has_space = virtio_transport_stream_has_space, ++ .stream_rcvhiwat = virtio_transport_stream_rcvhiwat, ++ .stream_is_active = virtio_transport_stream_is_active, ++ .stream_allow = virtio_transport_stream_allow, ++ ++ .notify_poll_in = virtio_transport_notify_poll_in, ++ .notify_poll_out = virtio_transport_notify_poll_out, ++ .notify_recv_init = virtio_transport_notify_recv_init, ++ .notify_recv_pre_block = virtio_transport_notify_recv_pre_block, ++ .notify_recv_pre_dequeue = virtio_transport_notify_recv_pre_dequeue, ++ .notify_recv_post_dequeue = virtio_transport_notify_recv_post_dequeue, ++ .notify_send_init = virtio_transport_notify_send_init, ++ .notify_send_pre_block = virtio_transport_notify_send_pre_block, ++ .notify_send_pre_enqueue = virtio_transport_notify_send_pre_enqueue, ++ .notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue, ++ ++ .set_buffer_size = virtio_transport_set_buffer_size, ++ .set_min_buffer_size = virtio_transport_set_min_buffer_size, ++ .set_max_buffer_size = virtio_transport_set_max_buffer_size, ++ .get_buffer_size = virtio_transport_get_buffer_size, ++ .get_min_buffer_size = virtio_transport_get_min_buffer_size, ++ .get_max_buffer_size = virtio_transport_get_max_buffer_size, ++ }, ++ ++ .send_pkt = vhost_transport_send_pkt, ++}; ++ + static void vhost_vsock_handle_tx_kick(struct vhost_work *work) + { + struct vhost_virtqueue *vq = container_of(work, struct vhost_virtqueue, +@@ -439,7 +485,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work) + if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid && + le64_to_cpu(pkt->hdr.dst_cid) == + vhost_transport_get_local_cid()) +- virtio_transport_recv_pkt(pkt); ++ virtio_transport_recv_pkt(&vhost_transport, pkt); + else + virtio_transport_free_pkt(pkt); + +@@ -780,52 +826,6 @@ static struct miscdevice vhost_vsock_misc = { + .fops = &vhost_vsock_fops, + }; + +-static struct virtio_transport vhost_transport = { +- .transport = { +- .get_local_cid = vhost_transport_get_local_cid, +- +- .init = virtio_transport_do_socket_init, +- .destruct = virtio_transport_destruct, +- .release = virtio_transport_release, +- .connect = virtio_transport_connect, +- .shutdown = virtio_transport_shutdown, +- .cancel_pkt = vhost_transport_cancel_pkt, +- +- .dgram_enqueue = virtio_transport_dgram_enqueue, +- .dgram_dequeue = virtio_transport_dgram_dequeue, +- .dgram_bind = virtio_transport_dgram_bind, +- .dgram_allow = virtio_transport_dgram_allow, +- +- .stream_enqueue = virtio_transport_stream_enqueue, +- .stream_dequeue = virtio_transport_stream_dequeue, +- .stream_has_data = virtio_transport_stream_has_data, +- .stream_has_space = virtio_transport_stream_has_space, +- .stream_rcvhiwat = virtio_transport_stream_rcvhiwat, +- .stream_is_active = virtio_transport_stream_is_active, +- .stream_allow = virtio_transport_stream_allow, +- +- .notify_poll_in = virtio_transport_notify_poll_in, +- .notify_poll_out = virtio_transport_notify_poll_out, +- .notify_recv_init = virtio_transport_notify_recv_init, +- .notify_recv_pre_block = virtio_transport_notify_recv_pre_block, +- .notify_recv_pre_dequeue = virtio_transport_notify_recv_pre_dequeue, +- .notify_recv_post_dequeue = virtio_transport_notify_recv_post_dequeue, +- .notify_send_init = virtio_transport_notify_send_init, +- .notify_send_pre_block = virtio_transport_notify_send_pre_block, +- .notify_send_pre_enqueue = virtio_transport_notify_send_pre_enqueue, +- .notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue, +- +- .set_buffer_size = virtio_transport_set_buffer_size, +- .set_min_buffer_size = virtio_transport_set_min_buffer_size, +- .set_max_buffer_size = virtio_transport_set_max_buffer_size, +- .get_buffer_size = virtio_transport_get_buffer_size, +- .get_min_buffer_size = virtio_transport_get_min_buffer_size, +- .get_max_buffer_size = virtio_transport_get_max_buffer_size, +- }, +- +- .send_pkt = vhost_transport_send_pkt, +-}; +- + static int __init vhost_vsock_init(void) + { + int ret; +diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c +index d3b0850391e0d..07d69d26fd361 100644 +--- a/drivers/video/console/newport_con.c ++++ b/drivers/video/console/newport_con.c +@@ -35,12 +35,6 @@ + + #define FONT_DATA ((unsigned char *)font_vga_8x16.data) + +-/* borrowed from fbcon.c */ +-#define REFCOUNT(fd) (((int *)(fd))[-1]) +-#define FNTSIZE(fd) (((int *)(fd))[-2]) +-#define FNTCHARCNT(fd) (((int *)(fd))[-3]) +-#define FONT_EXTRA_WORDS 3 +- + static unsigned char *font_data[MAX_NR_CONSOLES]; + + static struct newport_regs *npregs; +@@ -522,6 +516,7 @@ static int newport_set_font(int unit, struct console_font *op) + FNTSIZE(new_data) = size; + FNTCHARCNT(new_data) = op->charcount; + REFCOUNT(new_data) = 0; /* usage counter */ ++ FNTSUM(new_data) = 0; + + p = new_data; + for (i = 0; i < op->charcount; i++) { +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index 5825f057fb4b1..6bdf9ca787fbf 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -2248,6 +2248,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) + + if (font->width <= 8) { + j = vc->vc_font.height; ++ if (font->charcount * j > FNTSIZE(fontdata)) ++ return -EINVAL; ++ + for (i = 0; i < font->charcount; i++) { + memcpy(data, fontdata, j); + memset(data + j, 0, 32 - j); +@@ -2256,6 +2259,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) + } + } else if (font->width <= 16) { + j = vc->vc_font.height * 2; ++ if (font->charcount * j > FNTSIZE(fontdata)) ++ return -EINVAL; ++ + for (i = 0; i < font->charcount; i++) { + memcpy(data, fontdata, j); + memset(data + j, 0, 64 - j); +@@ -2263,6 +2269,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) + fontdata += j; + } + } else if (font->width <= 24) { ++ if (font->charcount * (vc->vc_font.height * sizeof(u32)) > FNTSIZE(fontdata)) ++ return -EINVAL; ++ + for (i = 0; i < font->charcount; i++) { + for (j = 0; j < vc->vc_font.height; j++) { + *data++ = fontdata[0]; +@@ -2275,6 +2284,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) + } + } else { + j = vc->vc_font.height * 4; ++ if (font->charcount * j > FNTSIZE(fontdata)) ++ return -EINVAL; ++ + for (i = 0; i < font->charcount; i++) { + memcpy(data, fontdata, j); + memset(data + j, 0, 128 - j); +diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h +index 0d85ad43caa3e..35128c1e191f7 100644 +--- a/drivers/video/fbdev/core/fbcon.h ++++ b/drivers/video/fbdev/core/fbcon.h +@@ -151,13 +151,6 @@ static inline int attr_col_ec(int shift, struct vc_data *vc, + #define attr_bgcol_ec(bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0) + #define attr_fgcol_ec(fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1) + +-/* Font */ +-#define REFCOUNT(fd) (((int *)(fd))[-1]) +-#define FNTSIZE(fd) (((int *)(fd))[-2]) +-#define FNTCHARCNT(fd) (((int *)(fd))[-3]) +-#define FNTSUM(fd) (((int *)(fd))[-4]) +-#define FONT_EXTRA_WORDS 4 +- + /* + * Scroll Method + */ +diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c +index 8a51e4d95cc50..e9a5c6a4b562d 100644 +--- a/drivers/video/fbdev/core/fbcon_rotate.c ++++ b/drivers/video/fbdev/core/fbcon_rotate.c +@@ -14,6 +14,7 @@ + #include <linux/fb.h> + #include <linux/vt_kern.h> + #include <linux/console.h> ++#include <linux/font.h> + #include <asm/types.h> + #include "fbcon.h" + #include "fbcon_rotate.h" +diff --git a/drivers/video/fbdev/core/tileblit.c b/drivers/video/fbdev/core/tileblit.c +index eb664dbf96f66..adff8d6ffe6f9 100644 +--- a/drivers/video/fbdev/core/tileblit.c ++++ b/drivers/video/fbdev/core/tileblit.c +@@ -13,6 +13,7 @@ + #include <linux/fb.h> + #include <linux/vt_kern.h> + #include <linux/console.h> ++#include <linux/font.h> + #include <asm/types.h> + #include "fbcon.h" + +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index de951987fd23d..19a668e9164b8 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -1257,6 +1257,7 @@ struct btrfs_root { + int send_in_progress; + struct btrfs_subvolume_writers *subv_writers; + atomic_t will_be_snapshotted; ++ atomic_t snapshot_force_cow; + + /* For qgroup metadata space reserve */ + atomic64_t qgroup_meta_rsv; +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 495430e4f84be..ace58d6a270b6 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1200,6 +1200,7 @@ static void __setup_root(struct btrfs_root *root, struct btrfs_fs_info *fs_info, + refcount_set(&root->refs, 1); + atomic_set(&root->will_be_snapshotted, 0); + atomic64_set(&root->qgroup_meta_rsv, 0); ++ atomic_set(&root->snapshot_force_cow, 0); + root->log_transid = 0; + root->log_transid_committed = -1; + root->last_log_commit = 0; +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index c9e7b92d0f212..e985e820724e1 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -1335,7 +1335,7 @@ static noinline int run_delalloc_nocow(struct inode *inode, + u64 disk_num_bytes; + u64 ram_bytes; + int extent_type; +- int ret, err; ++ int ret; + int type; + int nocow; + int check_prev = 1; +@@ -1460,11 +1460,8 @@ next_slot: + * if there are pending snapshots for this root, + * we fall into common COW way. + */ +- if (!nolock) { +- err = btrfs_start_write_no_snapshotting(root); +- if (!err) +- goto out_check; +- } ++ if (!nolock && atomic_read(&root->snapshot_force_cow)) ++ goto out_check; + /* + * force cow if csum exists in the range. + * this ensure that csum for a given extent are +@@ -1473,9 +1470,6 @@ next_slot: + ret = csum_exist_in_range(fs_info, disk_bytenr, + num_bytes); + if (ret) { +- if (!nolock) +- btrfs_end_write_no_snapshotting(root); +- + /* + * ret could be -EIO if the above fails to read + * metadata. +@@ -1488,11 +1482,8 @@ next_slot: + WARN_ON_ONCE(nolock); + goto out_check; + } +- if (!btrfs_inc_nocow_writers(fs_info, disk_bytenr)) { +- if (!nolock) +- btrfs_end_write_no_snapshotting(root); ++ if (!btrfs_inc_nocow_writers(fs_info, disk_bytenr)) + goto out_check; +- } + nocow = 1; + } else if (extent_type == BTRFS_FILE_EXTENT_INLINE) { + extent_end = found_key.offset + +@@ -1505,8 +1496,6 @@ next_slot: + out_check: + if (extent_end <= start) { + path->slots[0]++; +- if (!nolock && nocow) +- btrfs_end_write_no_snapshotting(root); + if (nocow) + btrfs_dec_nocow_writers(fs_info, disk_bytenr); + goto next_slot; +@@ -1528,8 +1517,6 @@ out_check: + end, page_started, nr_written, 1, + NULL); + if (ret) { +- if (!nolock && nocow) +- btrfs_end_write_no_snapshotting(root); + if (nocow) + btrfs_dec_nocow_writers(fs_info, + disk_bytenr); +@@ -1549,8 +1536,6 @@ out_check: + ram_bytes, BTRFS_COMPRESS_NONE, + BTRFS_ORDERED_PREALLOC); + if (IS_ERR(em)) { +- if (!nolock && nocow) +- btrfs_end_write_no_snapshotting(root); + if (nocow) + btrfs_dec_nocow_writers(fs_info, + disk_bytenr); +@@ -1589,8 +1574,6 @@ out_check: + EXTENT_CLEAR_DATA_RESV, + PAGE_UNLOCK | PAGE_SET_PRIVATE2); + +- if (!nolock && nocow) +- btrfs_end_write_no_snapshotting(root); + cur_offset = extent_end; + + /* +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 73a0fc60e395a..56123ce3b9f0e 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -655,6 +655,7 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir, + struct btrfs_pending_snapshot *pending_snapshot; + struct btrfs_trans_handle *trans; + int ret; ++ bool snapshot_force_cow = false; + + if (!test_bit(BTRFS_ROOT_REF_COWS, &root->state)) + return -EINVAL; +@@ -671,6 +672,11 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir, + goto free_pending; + } + ++ /* ++ * Force new buffered writes to reserve space even when NOCOW is ++ * possible. This is to avoid later writeback (running dealloc) to ++ * fallback to COW mode and unexpectedly fail with ENOSPC. ++ */ + atomic_inc(&root->will_be_snapshotted); + smp_mb__after_atomic(); + btrfs_wait_for_no_snapshotting_writes(root); +@@ -679,6 +685,14 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir, + if (ret) + goto dec_and_free; + ++ /* ++ * All previous writes have started writeback in NOCOW mode, so now ++ * we force future writes to fallback to COW mode during snapshot ++ * creation. ++ */ ++ atomic_inc(&root->snapshot_force_cow); ++ snapshot_force_cow = true; ++ + btrfs_wait_ordered_extents(root, U64_MAX, 0, (u64)-1); + + btrfs_init_block_rsv(&pending_snapshot->block_rsv, +@@ -744,6 +758,8 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir, + fail: + btrfs_subvolume_release_metadata(fs_info, &pending_snapshot->block_rsv); + dec_and_free: ++ if (snapshot_force_cow) ++ atomic_dec(&root->snapshot_force_cow); + if (atomic_dec_and_test(&root->will_be_snapshotted)) + wake_up_atomic_t(&root->will_be_snapshotted); + free_pending: +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 90d4288907a61..d2cfba90d9f8d 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -652,7 +652,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, + return rc; + } + +- len = sizeof(ea) + ea_name_len + ea_value_len + 1; ++ len = sizeof(*ea) + ea_name_len + ea_value_len + 1; + ea = kzalloc(len, GFP_KERNEL); + if (ea == NULL) { + SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid); +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index af9dfa494b1fa..c9feb119aa473 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -223,8 +223,7 @@ struct eventpoll { + struct file *file; + + /* used to optimize loop detection check */ +- int visited; +- struct list_head visited_list_link; ++ u64 gen; + + #ifdef CONFIG_NET_RX_BUSY_POLL + /* used to track busy poll napi_id */ +@@ -273,6 +272,8 @@ static long max_user_watches __read_mostly; + */ + static DEFINE_MUTEX(epmutex); + ++static u64 loop_check_gen = 0; ++ + /* Used to check for epoll file descriptor inclusion loops */ + static struct nested_calls poll_loop_ncalls; + +@@ -288,9 +289,6 @@ static struct kmem_cache *epi_cache __read_mostly; + /* Slab cache used to allocate "struct eppoll_entry" */ + static struct kmem_cache *pwq_cache __read_mostly; + +-/* Visited nodes during ep_loop_check(), so we can unset them when we finish */ +-static LIST_HEAD(visited_list); +- + /* + * List of files with newly added links, where we may need to limit the number + * of emanating paths. Protected by the epmutex. +@@ -1391,7 +1389,7 @@ static int reverse_path_check(void) + + static int ep_create_wakeup_source(struct epitem *epi) + { +- const char *name; ++ struct name_snapshot n; + struct wakeup_source *ws; + + if (!epi->ep->ws) { +@@ -1400,8 +1398,9 @@ static int ep_create_wakeup_source(struct epitem *epi) + return -ENOMEM; + } + +- name = epi->ffd.file->f_path.dentry->d_name.name; +- ws = wakeup_source_register(name); ++ take_dentry_name_snapshot(&n, epi->ffd.file->f_path.dentry); ++ ws = wakeup_source_register(n.name); ++ release_dentry_name_snapshot(&n); + + if (!ws) + return -ENOMEM; +@@ -1461,6 +1460,22 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event, + RCU_INIT_POINTER(epi->ws, NULL); + } + ++ /* Add the current item to the list of active epoll hook for this file */ ++ spin_lock(&tfile->f_lock); ++ list_add_tail_rcu(&epi->fllink, &tfile->f_ep_links); ++ spin_unlock(&tfile->f_lock); ++ ++ /* ++ * Add the current item to the RB tree. All RB tree operations are ++ * protected by "mtx", and ep_insert() is called with "mtx" held. ++ */ ++ ep_rbtree_insert(ep, epi); ++ ++ /* now check if we've created too many backpaths */ ++ error = -EINVAL; ++ if (full_check && reverse_path_check()) ++ goto error_remove_epi; ++ + /* Initialize the poll table using the queue callback */ + epq.epi = epi; + init_poll_funcptr(&epq.pt, ep_ptable_queue_proc); +@@ -1483,22 +1498,6 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event, + if (epi->nwait < 0) + goto error_unregister; + +- /* Add the current item to the list of active epoll hook for this file */ +- spin_lock(&tfile->f_lock); +- list_add_tail_rcu(&epi->fllink, &tfile->f_ep_links); +- spin_unlock(&tfile->f_lock); +- +- /* +- * Add the current item to the RB tree. All RB tree operations are +- * protected by "mtx", and ep_insert() is called with "mtx" held. +- */ +- ep_rbtree_insert(ep, epi); +- +- /* now check if we've created too many backpaths */ +- error = -EINVAL; +- if (full_check && reverse_path_check()) +- goto error_remove_epi; +- + /* We have to drop the new item inside our item list to keep track of it */ + spin_lock_irqsave(&ep->lock, flags); + +@@ -1527,6 +1526,8 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event, + + return 0; + ++error_unregister: ++ ep_unregister_pollwait(ep, epi); + error_remove_epi: + spin_lock(&tfile->f_lock); + list_del_rcu(&epi->fllink); +@@ -1534,9 +1535,6 @@ error_remove_epi: + + rb_erase_cached(&epi->rbn, &ep->rbr); + +-error_unregister: +- ep_unregister_pollwait(ep, epi); +- + /* + * We need to do this because an event could have been arrived on some + * allocated wait queue. Note that we don't care about the ep->ovflist +@@ -1878,13 +1876,12 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) + struct epitem *epi; + + mutex_lock_nested(&ep->mtx, call_nests + 1); +- ep->visited = 1; +- list_add(&ep->visited_list_link, &visited_list); ++ ep->gen = loop_check_gen; + for (rbp = rb_first_cached(&ep->rbr); rbp; rbp = rb_next(rbp)) { + epi = rb_entry(rbp, struct epitem, rbn); + if (unlikely(is_file_epoll(epi->ffd.file))) { + ep_tovisit = epi->ffd.file->private_data; +- if (ep_tovisit->visited) ++ if (ep_tovisit->gen == loop_check_gen) + continue; + error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, + ep_loop_check_proc, epi->ffd.file, +@@ -1925,18 +1922,8 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) + */ + static int ep_loop_check(struct eventpoll *ep, struct file *file) + { +- int ret; +- struct eventpoll *ep_cur, *ep_next; +- +- ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, ++ return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, + ep_loop_check_proc, file, ep, current); +- /* clear visited list */ +- list_for_each_entry_safe(ep_cur, ep_next, &visited_list, +- visited_list_link) { +- ep_cur->visited = 0; +- list_del(&ep_cur->visited_list_link); +- } +- return ret; + } + + static void clear_tfile_check_list(void) +@@ -2093,6 +2080,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, + mutex_lock_nested(&ep->mtx, 0); + if (op == EPOLL_CTL_ADD) { + if (!list_empty(&f.file->f_ep_links) || ++ ep->gen == loop_check_gen || + is_file_epoll(tf.file)) { + full_check = 1; + mutex_unlock(&ep->mtx); +@@ -2153,6 +2141,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, + error_tgt_fput: + if (full_check) { + clear_tfile_check_list(); ++ loop_check_gen++; + mutex_unlock(&epmutex); + } + +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 673d89bb817ea..5c26e90db5887 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -560,6 +560,9 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en + xdr_set_scratch_buffer(&stream, page_address(scratch), PAGE_SIZE); + + do { ++ if (entry->label) ++ entry->label->len = NFS4_MAXLABELLEN; ++ + status = xdr_decode(desc, entry, &stream); + if (status != 0) { + if (status == -EAGAIN) +diff --git a/include/linux/font.h b/include/linux/font.h +index d6821769dd1e1..f85e70bd4793e 100644 +--- a/include/linux/font.h ++++ b/include/linux/font.h +@@ -57,4 +57,17 @@ extern const struct font_desc *get_default_font(int xres, int yres, + /* Max. length for the name of a predefined font */ + #define MAX_FONT_NAME 32 + ++/* Extra word getters */ ++#define REFCOUNT(fd) (((int *)(fd))[-1]) ++#define FNTSIZE(fd) (((int *)(fd))[-2]) ++#define FNTCHARCNT(fd) (((int *)(fd))[-3]) ++#define FNTSUM(fd) (((int *)(fd))[-4]) ++ ++#define FONT_EXTRA_WORDS 4 ++ ++struct font_data { ++ unsigned int extra[FONT_EXTRA_WORDS]; ++ const unsigned char data[]; ++} __packed; ++ + #endif /* _VIDEO_FONT_H */ +diff --git a/include/linux/khugepaged.h b/include/linux/khugepaged.h +index 082d1d2a52169..dc9a2eecc8b80 100644 +--- a/include/linux/khugepaged.h ++++ b/include/linux/khugepaged.h +@@ -15,6 +15,7 @@ extern int __khugepaged_enter(struct mm_struct *mm); + extern void __khugepaged_exit(struct mm_struct *mm); + extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma, + unsigned long vm_flags); ++extern void khugepaged_min_free_kbytes_update(void); + + #define khugepaged_enabled() \ + (transparent_hugepage_flags & \ +@@ -73,6 +74,10 @@ static inline int khugepaged_enter_vma_merge(struct vm_area_struct *vma, + { + return 0; + } ++ ++static inline void khugepaged_min_free_kbytes_update(void) ++{ ++} + #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ + + #endif /* _LINUX_KHUGEPAGED_H */ +diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h +index e223e2632eddd..8b8d13f01caee 100644 +--- a/include/linux/virtio_vsock.h ++++ b/include/linux/virtio_vsock.h +@@ -149,7 +149,8 @@ virtio_transport_dgram_enqueue(struct vsock_sock *vsk, + + void virtio_transport_destruct(struct vsock_sock *vsk); + +-void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt); ++void virtio_transport_recv_pkt(struct virtio_transport *t, ++ struct virtio_vsock_pkt *pkt); + void virtio_transport_free_pkt(struct virtio_vsock_pkt *pkt); + void virtio_transport_inc_tx_pkt(struct virtio_vsock_sock *vvs, struct virtio_vsock_pkt *pkt); + u32 virtio_transport_get_credit(struct virtio_vsock_sock *vvs, u32 wanted); +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index 57b8b11cf7d42..86ff111574496 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -1808,21 +1808,17 @@ static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay + static inline int xfrm_replay_clone(struct xfrm_state *x, + struct xfrm_state *orig) + { +- x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn), ++ ++ x->replay_esn = kmemdup(orig->replay_esn, ++ xfrm_replay_state_esn_len(orig->replay_esn), + GFP_KERNEL); + if (!x->replay_esn) + return -ENOMEM; +- +- x->replay_esn->bmp_len = orig->replay_esn->bmp_len; +- x->replay_esn->replay_window = orig->replay_esn->replay_window; +- +- x->preplay_esn = kmemdup(x->replay_esn, +- xfrm_replay_state_esn_len(x->replay_esn), ++ x->preplay_esn = kmemdup(orig->preplay_esn, ++ xfrm_replay_state_esn_len(orig->preplay_esn), + GFP_KERNEL); +- if (!x->preplay_esn) { +- kfree(x->replay_esn); ++ if (!x->preplay_esn) + return -ENOMEM; +- } + + return 0; + } +diff --git a/kernel/events/core.c b/kernel/events/core.c +index e50b140053f9a..5807fad2c4057 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -98,7 +98,7 @@ static void remote_function(void *data) + * retry due to any failures in smp_call_function_single(), such as if the + * task_cpu() goes offline concurrently. + * +- * returns @func return value or -ESRCH when the process isn't running ++ * returns @func return value or -ESRCH or -ENXIO when the process isn't running + */ + static int + task_function_call(struct task_struct *p, remote_function_f func, void *info) +@@ -114,7 +114,8 @@ task_function_call(struct task_struct *p, remote_function_f func, void *info) + for (;;) { + ret = smp_call_function_single(task_cpu(p), remote_function, + &data, 1); +- ret = !ret ? data.ret : -EAGAIN; ++ if (!ret) ++ ret = data.ret; + + if (ret != -EAGAIN) + break; +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 7cbfccd2fb031..bb242da3724bf 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -6159,17 +6159,15 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip, + { + int bit; + +- if ((op->flags & FTRACE_OPS_FL_RCU) && !rcu_is_watching()) +- return; +- + bit = trace_test_and_set_recursion(TRACE_LIST_START, TRACE_LIST_MAX); + if (bit < 0) + return; + + preempt_disable_notrace(); + +- if (!(op->flags & FTRACE_OPS_FL_PER_CPU) || +- !ftrace_function_local_disabled(op)) { ++ if ((!(op->flags & FTRACE_OPS_FL_RCU) || rcu_is_watching()) && ++ (!(op->flags & FTRACE_OPS_FL_PER_CPU) || ++ !ftrace_function_local_disabled(op))) { + op->func(ip, parent_ip, op, regs); + } + +diff --git a/kernel/umh.c b/kernel/umh.c +index a5daa8534d0ed..9c41f05f969bf 100644 +--- a/kernel/umh.c ++++ b/kernel/umh.c +@@ -13,6 +13,7 @@ + #include <linux/cred.h> + #include <linux/file.h> + #include <linux/fdtable.h> ++#include <linux/fs_struct.h> + #include <linux/workqueue.h> + #include <linux/security.h> + #include <linux/mount.h> +@@ -70,6 +71,14 @@ static int call_usermodehelper_exec_async(void *data) + flush_signal_handlers(current, 1); + spin_unlock_irq(¤t->sighand->siglock); + ++ /* ++ * Initial kernel threads share ther FS with init, in order to ++ * get the init root directory. But we've now created a new ++ * thread that is going to execve a user process and has its own ++ * 'struct fs_struct'. Reset umask to the default. ++ */ ++ current->fs->umask = 0022; ++ + /* + * Our parent (unbound workqueue) runs with elevated scheduling + * priority. Avoid propagating that into the userspace child. +diff --git a/lib/fonts/font_10x18.c b/lib/fonts/font_10x18.c +index 532f0ff89a962..0e2deac97da0d 100644 +--- a/lib/fonts/font_10x18.c ++++ b/lib/fonts/font_10x18.c +@@ -8,8 +8,8 @@ + + #define FONTDATAMAX 9216 + +-static const unsigned char fontdata_10x18[FONTDATAMAX] = { +- ++static struct font_data fontdata_10x18 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, 0x00, /* 0000000000 */ + 0x00, 0x00, /* 0000000000 */ +@@ -5129,8 +5129,7 @@ static const unsigned char fontdata_10x18[FONTDATAMAX] = { + 0x00, 0x00, /* 0000000000 */ + 0x00, 0x00, /* 0000000000 */ + 0x00, 0x00, /* 0000000000 */ +- +-}; ++} }; + + + const struct font_desc font_10x18 = { +@@ -5138,7 +5137,7 @@ const struct font_desc font_10x18 = { + .name = "10x18", + .width = 10, + .height = 18, +- .data = fontdata_10x18, ++ .data = fontdata_10x18.data, + #ifdef __sparc__ + .pref = 5, + #else +diff --git a/lib/fonts/font_6x10.c b/lib/fonts/font_6x10.c +index 09b2cc03435b9..87da8acd07db0 100644 +--- a/lib/fonts/font_6x10.c ++++ b/lib/fonts/font_6x10.c +@@ -1,8 +1,10 @@ + // SPDX-License-Identifier: GPL-2.0 + #include <linux/font.h> + +-static const unsigned char fontdata_6x10[] = { ++#define FONTDATAMAX 2560 + ++static struct font_data fontdata_6x10 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +@@ -3074,14 +3076,13 @@ static const unsigned char fontdata_6x10[] = { + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +- +-}; ++} }; + + const struct font_desc font_6x10 = { + .idx = FONT6x10_IDX, + .name = "6x10", + .width = 6, + .height = 10, +- .data = fontdata_6x10, ++ .data = fontdata_6x10.data, + .pref = 0, + }; +diff --git a/lib/fonts/font_6x11.c b/lib/fonts/font_6x11.c +index d7136c33f1f01..5e975dfa10a53 100644 +--- a/lib/fonts/font_6x11.c ++++ b/lib/fonts/font_6x11.c +@@ -9,8 +9,8 @@ + + #define FONTDATAMAX (11*256) + +-static const unsigned char fontdata_6x11[FONTDATAMAX] = { +- ++static struct font_data fontdata_6x11 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +@@ -3338,8 +3338,7 @@ static const unsigned char fontdata_6x11[FONTDATAMAX] = { + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +- +-}; ++} }; + + + const struct font_desc font_vga_6x11 = { +@@ -3347,7 +3346,7 @@ const struct font_desc font_vga_6x11 = { + .name = "ProFont6x11", + .width = 6, + .height = 11, +- .data = fontdata_6x11, ++ .data = fontdata_6x11.data, + /* Try avoiding this font if possible unless on MAC */ + .pref = -2000, + }; +diff --git a/lib/fonts/font_7x14.c b/lib/fonts/font_7x14.c +index 9ae5b62c8a0db..6d74aa6026105 100644 +--- a/lib/fonts/font_7x14.c ++++ b/lib/fonts/font_7x14.c +@@ -8,8 +8,8 @@ + + #define FONTDATAMAX 3584 + +-static const unsigned char fontdata_7x14[FONTDATAMAX] = { +- ++static struct font_data fontdata_7x14 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 0000000 */ + 0x00, /* 0000000 */ +@@ -4105,8 +4105,7 @@ static const unsigned char fontdata_7x14[FONTDATAMAX] = { + 0x00, /* 0000000 */ + 0x00, /* 0000000 */ + 0x00, /* 0000000 */ +- +-}; ++} }; + + + const struct font_desc font_7x14 = { +@@ -4114,6 +4113,6 @@ const struct font_desc font_7x14 = { + .name = "7x14", + .width = 7, + .height = 14, +- .data = fontdata_7x14, ++ .data = fontdata_7x14.data, + .pref = 0, + }; +diff --git a/lib/fonts/font_8x16.c b/lib/fonts/font_8x16.c +index 34292cdfaa232..b7ae913e5b79d 100644 +--- a/lib/fonts/font_8x16.c ++++ b/lib/fonts/font_8x16.c +@@ -10,8 +10,8 @@ + + #define FONTDATAMAX 4096 + +-static const unsigned char fontdata_8x16[FONTDATAMAX] = { +- ++static struct font_data fontdata_8x16 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +@@ -4619,8 +4619,7 @@ static const unsigned char fontdata_8x16[FONTDATAMAX] = { + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +- +-}; ++} }; + + + const struct font_desc font_vga_8x16 = { +@@ -4628,7 +4627,7 @@ const struct font_desc font_vga_8x16 = { + .name = "VGA8x16", + .width = 8, + .height = 16, +- .data = fontdata_8x16, ++ .data = fontdata_8x16.data, + .pref = 0, + }; + EXPORT_SYMBOL(font_vga_8x16); +diff --git a/lib/fonts/font_8x8.c b/lib/fonts/font_8x8.c +index 751becf3c521e..51a736e167b54 100644 +--- a/lib/fonts/font_8x8.c ++++ b/lib/fonts/font_8x8.c +@@ -9,8 +9,8 @@ + + #define FONTDATAMAX 2048 + +-static const unsigned char fontdata_8x8[FONTDATAMAX] = { +- ++static struct font_data fontdata_8x8 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +@@ -2570,8 +2570,7 @@ static const unsigned char fontdata_8x8[FONTDATAMAX] = { + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +- +-}; ++} }; + + + const struct font_desc font_vga_8x8 = { +@@ -2579,6 +2578,6 @@ const struct font_desc font_vga_8x8 = { + .name = "VGA8x8", + .width = 8, + .height = 8, +- .data = fontdata_8x8, ++ .data = fontdata_8x8.data, + .pref = 0, + }; +diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c +index 0ff0e85d4481b..069b3e80c4344 100644 +--- a/lib/fonts/font_acorn_8x8.c ++++ b/lib/fonts/font_acorn_8x8.c +@@ -3,7 +3,10 @@ + + #include <linux/font.h> + +-static const unsigned char acorndata_8x8[] = { ++#define FONTDATAMAX 2048 ++ ++static struct font_data acorndata_8x8 = { ++{ 0, 0, FONTDATAMAX, 0 }, { + /* 00 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */ + /* 01 */ 0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */ + /* 02 */ 0x7e, 0xff, 0xbd, 0xff, 0xc3, 0xe7, 0xff, 0x7e, /* ^B */ +@@ -260,14 +263,14 @@ static const unsigned char acorndata_8x8[] = { + /* FD */ 0x38, 0x04, 0x18, 0x20, 0x3c, 0x00, 0x00, 0x00, + /* FE */ 0x00, 0x00, 0x3c, 0x3c, 0x3c, 0x3c, 0x00, 0x00, + /* FF */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 +-}; ++} }; + + const struct font_desc font_acorn_8x8 = { + .idx = ACORN8x8_IDX, + .name = "Acorn8x8", + .width = 8, + .height = 8, +- .data = acorndata_8x8, ++ .data = acorndata_8x8.data, + #ifdef CONFIG_ARCH_ACORN + .pref = 20, + #else +diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c +index 838caa1cfef70..1449876c6a270 100644 +--- a/lib/fonts/font_mini_4x6.c ++++ b/lib/fonts/font_mini_4x6.c +@@ -43,8 +43,8 @@ __END__; + + #define FONTDATAMAX 1536 + +-static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = { +- ++static struct font_data fontdata_mini_4x6 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /*{*/ + /* Char 0: ' ' */ + 0xee, /*= [*** ] */ +@@ -2145,14 +2145,14 @@ static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = { + 0xee, /*= [*** ] */ + 0x00, /*= [ ] */ + /*}*/ +-}; ++} }; + + const struct font_desc font_mini_4x6 = { + .idx = MINI4x6_IDX, + .name = "MINI4x6", + .width = 4, + .height = 6, +- .data = fontdata_mini_4x6, ++ .data = fontdata_mini_4x6.data, + .pref = 3, + }; + +diff --git a/lib/fonts/font_pearl_8x8.c b/lib/fonts/font_pearl_8x8.c +index b0514c0a74451..dc2cdfe218af6 100644 +--- a/lib/fonts/font_pearl_8x8.c ++++ b/lib/fonts/font_pearl_8x8.c +@@ -14,8 +14,8 @@ + + #define FONTDATAMAX 2048 + +-static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = { +- ++static struct font_data fontdata_pearl8x8 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +@@ -2575,14 +2575,13 @@ static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = { + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ + 0x00, /* 00000000 */ +- +-}; ++} }; + + const struct font_desc font_pearl_8x8 = { + .idx = PEARL8x8_IDX, + .name = "PEARL8x8", + .width = 8, + .height = 8, +- .data = fontdata_pearl8x8, ++ .data = fontdata_pearl8x8.data, + .pref = 2, + }; +diff --git a/lib/fonts/font_sun12x22.c b/lib/fonts/font_sun12x22.c +index 955d6eee3959d..641a6b4dca424 100644 +--- a/lib/fonts/font_sun12x22.c ++++ b/lib/fonts/font_sun12x22.c +@@ -3,8 +3,8 @@ + + #define FONTDATAMAX 11264 + +-static const unsigned char fontdata_sun12x22[FONTDATAMAX] = { +- ++static struct font_data fontdata_sun12x22 = { ++ { 0, 0, FONTDATAMAX, 0 }, { + /* 0 0x00 '^@' */ + 0x00, 0x00, /* 000000000000 */ + 0x00, 0x00, /* 000000000000 */ +@@ -6148,8 +6148,7 @@ static const unsigned char fontdata_sun12x22[FONTDATAMAX] = { + 0x00, 0x00, /* 000000000000 */ + 0x00, 0x00, /* 000000000000 */ + 0x00, 0x00, /* 000000000000 */ +- +-}; ++} }; + + + const struct font_desc font_sun_12x22 = { +@@ -6157,7 +6156,7 @@ const struct font_desc font_sun_12x22 = { + .name = "SUN12x22", + .width = 12, + .height = 22, +- .data = fontdata_sun12x22, ++ .data = fontdata_sun12x22.data, + #ifdef __sparc__ + .pref = 5, + #else +diff --git a/lib/fonts/font_sun8x16.c b/lib/fonts/font_sun8x16.c +index 03d71e53954ab..193fe6d988e08 100644 +--- a/lib/fonts/font_sun8x16.c ++++ b/lib/fonts/font_sun8x16.c +@@ -3,7 +3,8 @@ + + #define FONTDATAMAX 4096 + +-static const unsigned char fontdata_sun8x16[FONTDATAMAX] = { ++static struct font_data fontdata_sun8x16 = { ++{ 0, 0, FONTDATAMAX, 0 }, { + /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, + /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00, + /* */ 0x00,0x00,0x7e,0xff,0xdb,0xff,0xff,0xc3,0xe7,0xff,0xff,0x7e,0x00,0x00,0x00,0x00, +@@ -260,14 +261,14 @@ static const unsigned char fontdata_sun8x16[FONTDATAMAX] = { + /* */ 0x00,0x70,0xd8,0x30,0x60,0xc8,0xf8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, + /* */ 0x00,0x00,0x00,0x00,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x00,0x00,0x00,0x00,0x00, + /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, +-}; ++} }; + + const struct font_desc font_sun_8x16 = { + .idx = SUN8x16_IDX, + .name = "SUN8x16", + .width = 8, + .height = 16, +- .data = fontdata_sun8x16, ++ .data = fontdata_sun8x16.data, + #ifdef __sparc__ + .pref = 10, + #else +diff --git a/lib/random32.c b/lib/random32.c +index 6e2c48ab80722..eb54663e9e941 100644 +--- a/lib/random32.c ++++ b/lib/random32.c +@@ -48,7 +48,7 @@ static inline void prandom_state_selftest(void) + } + #endif + +-DEFINE_PER_CPU(struct rnd_state, net_rand_state); ++DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy; + + /** + * prandom_u32_state - seeded pseudo-random number generator. +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 9dfe364d4c0d1..349b4782d9f45 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -53,6 +53,9 @@ enum scan_result { + #define CREATE_TRACE_POINTS + #include <trace/events/huge_memory.h> + ++static struct task_struct *khugepaged_thread __read_mostly; ++static DEFINE_MUTEX(khugepaged_mutex); ++ + /* default scan 8*512 pte (or vmas) every 30 second */ + static unsigned int khugepaged_pages_to_scan __read_mostly; + static unsigned int khugepaged_pages_collapsed; +@@ -801,6 +804,18 @@ static struct page *khugepaged_alloc_hugepage(bool *wait) + + static bool khugepaged_prealloc_page(struct page **hpage, bool *wait) + { ++ /* ++ * If the hpage allocated earlier was briefly exposed in page cache ++ * before collapse_file() failed, it is possible that racing lookups ++ * have not yet completed, and would then be unpleasantly surprised by ++ * finding the hpage reused for the same mapping at a different offset. ++ * Just release the previous allocation if there is any danger of that. ++ */ ++ if (*hpage && page_count(*hpage) > 1) { ++ put_page(*hpage); ++ *hpage = NULL; ++ } ++ + if (!*hpage) + *hpage = khugepaged_alloc_hugepage(wait); + +@@ -1937,8 +1952,6 @@ static void set_recommended_min_free_kbytes(void) + + int start_stop_khugepaged(void) + { +- static struct task_struct *khugepaged_thread __read_mostly; +- static DEFINE_MUTEX(khugepaged_mutex); + int err = 0; + + mutex_lock(&khugepaged_mutex); +@@ -1965,3 +1978,11 @@ fail: + mutex_unlock(&khugepaged_mutex); + return err; + } ++ ++void khugepaged_min_free_kbytes_update(void) ++{ ++ mutex_lock(&khugepaged_mutex); ++ if (khugepaged_enabled() && khugepaged_thread) ++ set_recommended_min_free_kbytes(); ++ mutex_unlock(&khugepaged_mutex); ++} +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index a3958b4fec6cb..7183807d494fe 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -67,6 +67,7 @@ + #include <linux/ftrace.h> + #include <linux/lockdep.h> + #include <linux/nmi.h> ++#include <linux/khugepaged.h> + + #include <asm/sections.h> + #include <asm/tlbflush.h> +@@ -7021,6 +7022,8 @@ int __meminit init_per_zone_wmark_min(void) + setup_min_slab_ratio(); + #endif + ++ khugepaged_min_free_kbytes_update(); ++ + return 0; + } + postcore_initcall(init_per_zone_wmark_min) +diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c +index 19ec2189d3acb..502b3fbb3b0f4 100644 +--- a/net/mac80211/vht.c ++++ b/net/mac80211/vht.c +@@ -170,10 +170,7 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata, + /* take some capabilities as-is */ + cap_info = le32_to_cpu(vht_cap_ie->vht_cap_info); + vht_cap->cap = cap_info; +- vht_cap->cap &= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895 | +- IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991 | +- IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 | +- IEEE80211_VHT_CAP_RXLDPC | ++ vht_cap->cap &= IEEE80211_VHT_CAP_RXLDPC | + IEEE80211_VHT_CAP_VHT_TXOP_PS | + IEEE80211_VHT_CAP_HTC_VHT | + IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK | +@@ -182,6 +179,9 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata, + IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN | + IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN; + ++ vht_cap->cap |= min_t(u32, cap_info & IEEE80211_VHT_CAP_MAX_MPDU_MASK, ++ own_cap.cap & IEEE80211_VHT_CAP_MAX_MPDU_MASK); ++ + /* and some based on our own capabilities */ + switch (own_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) { + case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ: +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 39a32edaa92c2..a83147f701da4 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -1043,6 +1043,8 @@ ctnetlink_parse_tuple(const struct nlattr * const cda[], + if (!tb[CTA_TUPLE_IP]) + return -EINVAL; + ++ if (l3num != NFPROTO_IPV4 && l3num != NFPROTO_IPV6) ++ return -EOPNOTSUPP; + tuple->src.l3num = l3num; + + err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple); +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index a39ef1a048fde..3d74e33bf8298 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -881,15 +881,19 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, + } + err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); + +- if (err == NF_ACCEPT && +- ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) { +- if (maniptype == NF_NAT_MANIP_SRC) +- maniptype = NF_NAT_MANIP_DST; +- else +- maniptype = NF_NAT_MANIP_SRC; +- +- err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, +- maniptype); ++ if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) { ++ if (ct->status & IPS_SRC_NAT) { ++ if (maniptype == NF_NAT_MANIP_SRC) ++ maniptype = NF_NAT_MANIP_DST; ++ else ++ maniptype = NF_NAT_MANIP_SRC; ++ ++ err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, ++ maniptype); ++ } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) { ++ err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL, ++ NF_NAT_MANIP_SRC); ++ } + } + + /* Mark NAT done if successful and update the flow key. */ +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index c2356611b3cba..b62ec43ed54f4 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2201,7 +2201,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + int skb_len = skb->len; + unsigned int snaplen, res; + unsigned long status = TP_STATUS_USER; +- unsigned short macoff, netoff, hdrlen; ++ unsigned short macoff, hdrlen; ++ unsigned int netoff; + struct sk_buff *copy_skb = NULL; + struct timespec ts; + __u32 ts_status; +@@ -2264,6 +2265,12 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + } + macoff = netoff - maclen; + } ++ if (netoff > USHRT_MAX) { ++ spin_lock(&sk->sk_receive_queue.lock); ++ po->stats.stats1.tp_drops++; ++ spin_unlock(&sk->sk_receive_queue.lock); ++ goto drop_n_restore; ++ } + if (po->tp_version <= TPACKET_V2) { + if (macoff + snaplen > po->rx_ring.frame_size) { + if (po->copy_thresh && +diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c +index 75ec1ad595b72..2432c118397f6 100644 +--- a/net/rxrpc/conn_event.c ++++ b/net/rxrpc/conn_event.c +@@ -316,18 +316,18 @@ static int rxrpc_process_event(struct rxrpc_connection *conn, + return ret; + + spin_lock(&conn->channel_lock); +- spin_lock(&conn->state_lock); ++ spin_lock_bh(&conn->state_lock); + + if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) { + conn->state = RXRPC_CONN_SERVICE; +- spin_unlock(&conn->state_lock); ++ spin_unlock_bh(&conn->state_lock); + for (loop = 0; loop < RXRPC_MAXCALLS; loop++) + rxrpc_call_is_secure( + rcu_dereference_protected( + conn->channels[loop].call, + lockdep_is_held(&conn->channel_lock))); + } else { +- spin_unlock(&conn->state_lock); ++ spin_unlock_bh(&conn->state_lock); + } + + spin_unlock(&conn->channel_lock); +diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c +index ad9d1b21cb0ba..2fe2add62a8ed 100644 +--- a/net/rxrpc/key.c ++++ b/net/rxrpc/key.c +@@ -905,7 +905,7 @@ int rxrpc_request_key(struct rxrpc_sock *rx, char __user *optval, int optlen) + + _enter(""); + +- if (optlen <= 0 || optlen > PAGE_SIZE - 1) ++ if (optlen <= 0 || optlen > PAGE_SIZE - 1 || rx->securities) + return -EINVAL; + + description = memdup_user_nul(optval, optlen); +@@ -1075,7 +1075,7 @@ static long rxrpc_read(const struct key *key, + + switch (token->security_index) { + case RXRPC_SECURITY_RXKAD: +- toksize += 9 * 4; /* viceid, kvno, key*2 + len, begin, ++ toksize += 8 * 4; /* viceid, kvno, key*2, begin, + * end, primary, tktlen */ + toksize += RND(token->kad->ticket_len); + break; +@@ -1110,7 +1110,8 @@ static long rxrpc_read(const struct key *key, + break; + + default: /* we have a ticket we can't encode */ +- BUG(); ++ pr_err("Unsupported key token type (%u)\n", ++ token->security_index); + continue; + } + +@@ -1141,6 +1142,14 @@ static long rxrpc_read(const struct key *key, + memcpy((u8 *)xdr + _l, &zero, 4 - (_l & 3)); \ + xdr += (_l + 3) >> 2; \ + } while(0) ++#define ENCODE_BYTES(l, s) \ ++ do { \ ++ u32 _l = (l); \ ++ memcpy(xdr, (s), _l); \ ++ if (_l & 3) \ ++ memcpy((u8 *)xdr + _l, &zero, 4 - (_l & 3)); \ ++ xdr += (_l + 3) >> 2; \ ++ } while(0) + #define ENCODE64(x) \ + do { \ + __be64 y = cpu_to_be64(x); \ +@@ -1168,7 +1177,7 @@ static long rxrpc_read(const struct key *key, + case RXRPC_SECURITY_RXKAD: + ENCODE(token->kad->vice_id); + ENCODE(token->kad->kvno); +- ENCODE_DATA(8, token->kad->session_key); ++ ENCODE_BYTES(8, token->kad->session_key); + ENCODE(token->kad->start); + ENCODE(token->kad->expiry); + ENCODE(token->kad->primary_flag); +@@ -1218,7 +1227,6 @@ static long rxrpc_read(const struct key *key, + break; + + default: +- BUG(); + break; + } + +diff --git a/net/sctp/auth.c b/net/sctp/auth.c +index 00667c50efa7a..9d7e729609195 100644 +--- a/net/sctp/auth.c ++++ b/net/sctp/auth.c +@@ -493,6 +493,7 @@ int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp) + out_err: + /* Clean up any successful allocations */ + sctp_auth_destroy_hmacs(ep->auth_hmacs); ++ ep->auth_hmacs = NULL; + return -ENOMEM; + } + +diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c +index 96ab344f17bbc..cc70d651d13e0 100644 +--- a/net/vmw_vsock/virtio_transport.c ++++ b/net/vmw_vsock/virtio_transport.c +@@ -39,6 +39,7 @@ struct virtio_vsock { + * must be accessed with tx_lock held. + */ + struct mutex tx_lock; ++ bool tx_run; + + struct work_struct send_pkt_work; + spinlock_t send_pkt_list_lock; +@@ -54,6 +55,7 @@ struct virtio_vsock { + * must be accessed with rx_lock held. + */ + struct mutex rx_lock; ++ bool rx_run; + int rx_buf_nr; + int rx_buf_max_nr; + +@@ -61,46 +63,28 @@ struct virtio_vsock { + * vqs[VSOCK_VQ_EVENT] must be accessed with event_lock held. + */ + struct mutex event_lock; ++ bool event_run; + struct virtio_vsock_event event_list[8]; + + u32 guest_cid; + }; + +-static struct virtio_vsock *virtio_vsock_get(void) +-{ +- return the_virtio_vsock; +-} +- + static u32 virtio_transport_get_local_cid(void) + { +- struct virtio_vsock *vsock = virtio_vsock_get(); +- +- if (!vsock) +- return VMADDR_CID_ANY; +- +- return vsock->guest_cid; +-} +- +-static void virtio_transport_loopback_work(struct work_struct *work) +-{ +- struct virtio_vsock *vsock = +- container_of(work, struct virtio_vsock, loopback_work); +- LIST_HEAD(pkts); +- +- spin_lock_bh(&vsock->loopback_list_lock); +- list_splice_init(&vsock->loopback_list, &pkts); +- spin_unlock_bh(&vsock->loopback_list_lock); +- +- mutex_lock(&vsock->rx_lock); +- while (!list_empty(&pkts)) { +- struct virtio_vsock_pkt *pkt; +- +- pkt = list_first_entry(&pkts, struct virtio_vsock_pkt, list); +- list_del_init(&pkt->list); ++ struct virtio_vsock *vsock; ++ u32 ret; + +- virtio_transport_recv_pkt(pkt); ++ rcu_read_lock(); ++ vsock = rcu_dereference(the_virtio_vsock); ++ if (!vsock) { ++ ret = VMADDR_CID_ANY; ++ goto out_rcu; + } +- mutex_unlock(&vsock->rx_lock); ++ ++ ret = vsock->guest_cid; ++out_rcu: ++ rcu_read_unlock(); ++ return ret; + } + + static int virtio_transport_send_pkt_loopback(struct virtio_vsock *vsock, +@@ -128,6 +112,9 @@ virtio_transport_send_pkt_work(struct work_struct *work) + + mutex_lock(&vsock->tx_lock); + ++ if (!vsock->tx_run) ++ goto out; ++ + vq = vsock->vqs[VSOCK_VQ_TX]; + + for (;;) { +@@ -186,6 +173,7 @@ virtio_transport_send_pkt_work(struct work_struct *work) + if (added) + virtqueue_kick(vq); + ++out: + mutex_unlock(&vsock->tx_lock); + + if (restart_rx) +@@ -198,14 +186,18 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt) + struct virtio_vsock *vsock; + int len = pkt->len; + +- vsock = virtio_vsock_get(); ++ rcu_read_lock(); ++ vsock = rcu_dereference(the_virtio_vsock); + if (!vsock) { + virtio_transport_free_pkt(pkt); +- return -ENODEV; ++ len = -ENODEV; ++ goto out_rcu; + } + +- if (le64_to_cpu(pkt->hdr.dst_cid) == vsock->guest_cid) +- return virtio_transport_send_pkt_loopback(vsock, pkt); ++ if (le64_to_cpu(pkt->hdr.dst_cid) == vsock->guest_cid) { ++ len = virtio_transport_send_pkt_loopback(vsock, pkt); ++ goto out_rcu; ++ } + + if (pkt->reply) + atomic_inc(&vsock->queued_replies); +@@ -215,6 +207,9 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt) + spin_unlock_bh(&vsock->send_pkt_list_lock); + + queue_work(virtio_vsock_workqueue, &vsock->send_pkt_work); ++ ++out_rcu: ++ rcu_read_unlock(); + return len; + } + +@@ -223,12 +218,14 @@ virtio_transport_cancel_pkt(struct vsock_sock *vsk) + { + struct virtio_vsock *vsock; + struct virtio_vsock_pkt *pkt, *n; +- int cnt = 0; ++ int cnt = 0, ret; + LIST_HEAD(freeme); + +- vsock = virtio_vsock_get(); ++ rcu_read_lock(); ++ vsock = rcu_dereference(the_virtio_vsock); + if (!vsock) { +- return -ENODEV; ++ ret = -ENODEV; ++ goto out_rcu; + } + + spin_lock_bh(&vsock->send_pkt_list_lock); +@@ -256,7 +253,11 @@ virtio_transport_cancel_pkt(struct vsock_sock *vsk) + queue_work(virtio_vsock_workqueue, &vsock->rx_work); + } + +- return 0; ++ ret = 0; ++ ++out_rcu: ++ rcu_read_unlock(); ++ return ret; + } + + static void virtio_vsock_rx_fill(struct virtio_vsock *vsock) +@@ -308,6 +309,10 @@ static void virtio_transport_tx_work(struct work_struct *work) + + vq = vsock->vqs[VSOCK_VQ_TX]; + mutex_lock(&vsock->tx_lock); ++ ++ if (!vsock->tx_run) ++ goto out; ++ + do { + struct virtio_vsock_pkt *pkt; + unsigned int len; +@@ -318,6 +323,8 @@ static void virtio_transport_tx_work(struct work_struct *work) + added = true; + } + } while (!virtqueue_enable_cb(vq)); ++ ++out: + mutex_unlock(&vsock->tx_lock); + + if (added) +@@ -336,56 +343,6 @@ static bool virtio_transport_more_replies(struct virtio_vsock *vsock) + return val < virtqueue_get_vring_size(vq); + } + +-static void virtio_transport_rx_work(struct work_struct *work) +-{ +- struct virtio_vsock *vsock = +- container_of(work, struct virtio_vsock, rx_work); +- struct virtqueue *vq; +- +- vq = vsock->vqs[VSOCK_VQ_RX]; +- +- mutex_lock(&vsock->rx_lock); +- +- do { +- virtqueue_disable_cb(vq); +- for (;;) { +- struct virtio_vsock_pkt *pkt; +- unsigned int len; +- +- if (!virtio_transport_more_replies(vsock)) { +- /* Stop rx until the device processes already +- * pending replies. Leave rx virtqueue +- * callbacks disabled. +- */ +- goto out; +- } +- +- pkt = virtqueue_get_buf(vq, &len); +- if (!pkt) { +- break; +- } +- +- vsock->rx_buf_nr--; +- +- /* Drop short/long packets */ +- if (unlikely(len < sizeof(pkt->hdr) || +- len > sizeof(pkt->hdr) + pkt->len)) { +- virtio_transport_free_pkt(pkt); +- continue; +- } +- +- pkt->len = len - sizeof(pkt->hdr); +- virtio_transport_deliver_tap_pkt(pkt); +- virtio_transport_recv_pkt(pkt); +- } +- } while (!virtqueue_enable_cb(vq)); +- +-out: +- if (vsock->rx_buf_nr < vsock->rx_buf_max_nr / 2) +- virtio_vsock_rx_fill(vsock); +- mutex_unlock(&vsock->rx_lock); +-} +- + /* event_lock must be held */ + static int virtio_vsock_event_fill_one(struct virtio_vsock *vsock, + struct virtio_vsock_event *event) +@@ -455,6 +412,9 @@ static void virtio_transport_event_work(struct work_struct *work) + + mutex_lock(&vsock->event_lock); + ++ if (!vsock->event_run) ++ goto out; ++ + do { + struct virtio_vsock_event *event; + unsigned int len; +@@ -469,7 +429,7 @@ static void virtio_transport_event_work(struct work_struct *work) + } while (!virtqueue_enable_cb(vq)); + + virtqueue_kick(vsock->vqs[VSOCK_VQ_EVENT]); +- ++out: + mutex_unlock(&vsock->event_lock); + } + +@@ -546,6 +506,86 @@ static struct virtio_transport virtio_transport = { + .send_pkt = virtio_transport_send_pkt, + }; + ++static void virtio_transport_loopback_work(struct work_struct *work) ++{ ++ struct virtio_vsock *vsock = ++ container_of(work, struct virtio_vsock, loopback_work); ++ LIST_HEAD(pkts); ++ ++ spin_lock_bh(&vsock->loopback_list_lock); ++ list_splice_init(&vsock->loopback_list, &pkts); ++ spin_unlock_bh(&vsock->loopback_list_lock); ++ ++ mutex_lock(&vsock->rx_lock); ++ ++ if (!vsock->rx_run) ++ goto out; ++ ++ while (!list_empty(&pkts)) { ++ struct virtio_vsock_pkt *pkt; ++ ++ pkt = list_first_entry(&pkts, struct virtio_vsock_pkt, list); ++ list_del_init(&pkt->list); ++ ++ virtio_transport_recv_pkt(&virtio_transport, pkt); ++ } ++out: ++ mutex_unlock(&vsock->rx_lock); ++} ++ ++static void virtio_transport_rx_work(struct work_struct *work) ++{ ++ struct virtio_vsock *vsock = ++ container_of(work, struct virtio_vsock, rx_work); ++ struct virtqueue *vq; ++ ++ vq = vsock->vqs[VSOCK_VQ_RX]; ++ ++ mutex_lock(&vsock->rx_lock); ++ ++ if (!vsock->rx_run) ++ goto out; ++ ++ do { ++ virtqueue_disable_cb(vq); ++ for (;;) { ++ struct virtio_vsock_pkt *pkt; ++ unsigned int len; ++ ++ if (!virtio_transport_more_replies(vsock)) { ++ /* Stop rx until the device processes already ++ * pending replies. Leave rx virtqueue ++ * callbacks disabled. ++ */ ++ goto out; ++ } ++ ++ pkt = virtqueue_get_buf(vq, &len); ++ if (!pkt) { ++ break; ++ } ++ ++ vsock->rx_buf_nr--; ++ ++ /* Drop short/long packets */ ++ if (unlikely(len < sizeof(pkt->hdr) || ++ len > sizeof(pkt->hdr) + pkt->len)) { ++ virtio_transport_free_pkt(pkt); ++ continue; ++ } ++ ++ pkt->len = len - sizeof(pkt->hdr); ++ virtio_transport_deliver_tap_pkt(pkt); ++ virtio_transport_recv_pkt(&virtio_transport, pkt); ++ } ++ } while (!virtqueue_enable_cb(vq)); ++ ++out: ++ if (vsock->rx_buf_nr < vsock->rx_buf_max_nr / 2) ++ virtio_vsock_rx_fill(vsock); ++ mutex_unlock(&vsock->rx_lock); ++} ++ + static int virtio_vsock_probe(struct virtio_device *vdev) + { + vq_callback_t *callbacks[] = { +@@ -566,7 +606,8 @@ static int virtio_vsock_probe(struct virtio_device *vdev) + return ret; + + /* Only one virtio-vsock device per guest is supported */ +- if (the_virtio_vsock) { ++ if (rcu_dereference_protected(the_virtio_vsock, ++ lockdep_is_held(&the_virtio_vsock_mutex))) { + ret = -EBUSY; + goto out; + } +@@ -591,8 +632,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev) + vsock->rx_buf_max_nr = 0; + atomic_set(&vsock->queued_replies, 0); + +- vdev->priv = vsock; +- the_virtio_vsock = vsock; + mutex_init(&vsock->tx_lock); + mutex_init(&vsock->rx_lock); + mutex_init(&vsock->event_lock); +@@ -606,14 +645,23 @@ static int virtio_vsock_probe(struct virtio_device *vdev) + INIT_WORK(&vsock->send_pkt_work, virtio_transport_send_pkt_work); + INIT_WORK(&vsock->loopback_work, virtio_transport_loopback_work); + ++ mutex_lock(&vsock->tx_lock); ++ vsock->tx_run = true; ++ mutex_unlock(&vsock->tx_lock); ++ + mutex_lock(&vsock->rx_lock); + virtio_vsock_rx_fill(vsock); ++ vsock->rx_run = true; + mutex_unlock(&vsock->rx_lock); + + mutex_lock(&vsock->event_lock); + virtio_vsock_event_fill(vsock); ++ vsock->event_run = true; + mutex_unlock(&vsock->event_lock); + ++ vdev->priv = vsock; ++ rcu_assign_pointer(the_virtio_vsock, vsock); ++ + mutex_unlock(&the_virtio_vsock_mutex); + return 0; + +@@ -628,6 +676,12 @@ static void virtio_vsock_remove(struct virtio_device *vdev) + struct virtio_vsock *vsock = vdev->priv; + struct virtio_vsock_pkt *pkt; + ++ mutex_lock(&the_virtio_vsock_mutex); ++ ++ vdev->priv = NULL; ++ rcu_assign_pointer(the_virtio_vsock, NULL); ++ synchronize_rcu(); ++ + flush_work(&vsock->loopback_work); + flush_work(&vsock->rx_work); + flush_work(&vsock->tx_work); +@@ -637,6 +691,24 @@ static void virtio_vsock_remove(struct virtio_device *vdev) + /* Reset all connected sockets when the device disappear */ + vsock_for_each_connected_socket(virtio_vsock_reset_sock); + ++ /* Stop all work handlers to make sure no one is accessing the device, ++ * so we can safely call vdev->config->reset(). ++ */ ++ mutex_lock(&vsock->rx_lock); ++ vsock->rx_run = false; ++ mutex_unlock(&vsock->rx_lock); ++ ++ mutex_lock(&vsock->tx_lock); ++ vsock->tx_run = false; ++ mutex_unlock(&vsock->tx_lock); ++ ++ mutex_lock(&vsock->event_lock); ++ vsock->event_run = false; ++ mutex_unlock(&vsock->event_lock); ++ ++ /* Flush all device writes and interrupts, device will not use any ++ * more buffers. ++ */ + vdev->config->reset(vdev); + + mutex_lock(&vsock->rx_lock); +@@ -667,12 +739,11 @@ static void virtio_vsock_remove(struct virtio_device *vdev) + } + spin_unlock_bh(&vsock->loopback_list_lock); + +- mutex_lock(&the_virtio_vsock_mutex); +- the_virtio_vsock = NULL; +- mutex_unlock(&the_virtio_vsock_mutex); +- ++ /* Delete virtqueues and flush outstanding callbacks if any */ + vdev->config->del_vqs(vdev); + ++ mutex_unlock(&the_virtio_vsock_mutex); ++ + kfree(vsock); + } + +diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c +index d20f43057323e..8e4c13cc61ba8 100644 +--- a/net/vmw_vsock/virtio_transport_common.c ++++ b/net/vmw_vsock/virtio_transport_common.c +@@ -669,9 +669,9 @@ static int virtio_transport_reset(struct vsock_sock *vsk, + /* Normally packets are associated with a socket. There may be no socket if an + * attempt was made to connect to a socket that does not exist. + */ +-static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt) ++static int virtio_transport_reset_no_sock(const struct virtio_transport *t, ++ struct virtio_vsock_pkt *pkt) + { +- const struct virtio_transport *t; + struct virtio_vsock_pkt *reply; + struct virtio_vsock_pkt_info info = { + .op = VIRTIO_VSOCK_OP_RST, +@@ -691,7 +691,6 @@ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt) + if (!reply) + return -ENOMEM; + +- t = virtio_transport_get_ops(); + if (!t) { + virtio_transport_free_pkt(reply); + return -ENOTCONN; +@@ -989,7 +988,8 @@ static bool virtio_transport_space_update(struct sock *sk, + /* We are under the virtio-vsock's vsock->rx_lock or vhost-vsock's vq->mutex + * lock. + */ +-void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt) ++void virtio_transport_recv_pkt(struct virtio_transport *t, ++ struct virtio_vsock_pkt *pkt) + { + struct sockaddr_vm src, dst; + struct vsock_sock *vsk; +@@ -1011,7 +1011,7 @@ void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt) + le32_to_cpu(pkt->hdr.fwd_cnt)); + + if (le16_to_cpu(pkt->hdr.type) != VIRTIO_VSOCK_TYPE_STREAM) { +- (void)virtio_transport_reset_no_sock(pkt); ++ (void)virtio_transport_reset_no_sock(t, pkt); + goto free_pkt; + } + +@@ -1022,7 +1022,7 @@ void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt) + if (!sk) { + sk = vsock_find_bound_socket(&dst); + if (!sk) { +- (void)virtio_transport_reset_no_sock(pkt); ++ (void)virtio_transport_reset_no_sock(t, pkt); + goto free_pkt; + } + } +@@ -1056,6 +1056,7 @@ void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt) + virtio_transport_free_pkt(pkt); + break; + default: ++ (void)virtio_transport_reset_no_sock(t, pkt); + virtio_transport_free_pkt(pkt); + break; + } +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 9be7ee322093b..bf3caa376f9fe 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -3343,6 +3343,9 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) + if (err) + return err; + ++ if (key.idx < 0) ++ return -EINVAL; ++ + if (info->attrs[NL80211_ATTR_MAC]) + mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); + +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 190ca59d5ba31..05c275a712f11 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -909,7 +909,8 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, + */ + if (x->km.state == XFRM_STATE_VALID) { + if ((x->sel.family && +- !xfrm_selector_match(&x->sel, fl, x->sel.family)) || ++ (x->sel.family != family || ++ !xfrm_selector_match(&x->sel, fl, family))) || + !security_xfrm_state_pol_flow_match(x, pol, fl)) + return; + +@@ -922,7 +923,9 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x, + *acq_in_progress = 1; + } else if (x->km.state == XFRM_STATE_ERROR || + x->km.state == XFRM_STATE_EXPIRED) { +- if (xfrm_selector_match(&x->sel, fl, x->sel.family) && ++ if ((!x->sel.family || ++ (x->sel.family == family && ++ xfrm_selector_match(&x->sel, fl, family))) && + security_xfrm_state_pol_flow_match(x, pol, fl)) + *error = -ESRCH; + } +@@ -961,7 +964,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + tmpl->mode == x->props.mode && + tmpl->id.proto == x->id.proto && + (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) +- xfrm_state_look_at(pol, x, fl, encap_family, ++ xfrm_state_look_at(pol, x, fl, family, + &best, &acquire_in_progress, &error); + } + if (best || acquire_in_progress) +@@ -977,7 +980,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + tmpl->mode == x->props.mode && + tmpl->id.proto == x->id.proto && + (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) +- xfrm_state_look_at(pol, x, fl, encap_family, ++ xfrm_state_look_at(pol, x, fl, family, + &best, &acquire_in_progress, &error); + } + +@@ -1320,6 +1323,30 @@ out: + EXPORT_SYMBOL(xfrm_state_add); + + #ifdef CONFIG_XFRM_MIGRATE ++static inline int clone_security(struct xfrm_state *x, struct xfrm_sec_ctx *security) ++{ ++ struct xfrm_user_sec_ctx *uctx; ++ int size = sizeof(*uctx) + security->ctx_len; ++ int err; ++ ++ uctx = kmalloc(size, GFP_KERNEL); ++ if (!uctx) ++ return -ENOMEM; ++ ++ uctx->exttype = XFRMA_SEC_CTX; ++ uctx->len = size; ++ uctx->ctx_doi = security->ctx_doi; ++ uctx->ctx_alg = security->ctx_alg; ++ uctx->ctx_len = security->ctx_len; ++ memcpy(uctx + 1, security->ctx_str, security->ctx_len); ++ err = security_xfrm_state_alloc(x, uctx); ++ kfree(uctx); ++ if (err) ++ return err; ++ ++ return 0; ++} ++ + static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, + struct xfrm_encap_tmpl *encap) + { +@@ -1376,6 +1403,10 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, + goto error; + } + ++ if (orig->security) ++ if (clone_security(x, orig->security)) ++ goto error; ++ + if (orig->coaddr) { + x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr), + GFP_KERNEL); +@@ -1399,7 +1430,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, + x->tfcpad = orig->tfcpad; + x->replay_maxdiff = orig->replay_maxdiff; + x->replay_maxage = orig->replay_maxage; +- x->curlft.add_time = orig->curlft.add_time; ++ memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft)); + x->km.state = orig->km.state; + x->km.seq = orig->km.seq; + x->replay = orig->replay; +diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c +index 133eb79493211..d5bdcbb4d4369 100644 +--- a/tools/perf/builtin-top.c ++++ b/tools/perf/builtin-top.c +@@ -652,7 +652,9 @@ repeat: + delay_msecs = top->delay_secs * MSEC_PER_SEC; + set_term_quiet_input(&save); + /* trash return*/ +- getc(stdin); ++ clearerr(stdin); ++ if (poll(&stdin_poll, 1, 0) > 0) ++ getc(stdin); + + while (!done) { + perf_top__print_sym_table(top);
